Binance Hot Wallets Suspected of Hacker Attack, Billions of Dollars Flowed Out; Polymarket UI Breached on Same Day

Original | Odaily (@OdailyChina)

Author | jk

On the evening of October 29 (from 20:24 UTC, around 4 AM Beijing time on October 30), multiple Binance hot wallets were suspected of being attacked, transferring billions of dollars in assets to newly created addresses within a short period, and Etherscan promptly flagged the relevant addresses as "Binance Hot Wallet Hacker." Binance stated officially that user funds are safe and that the team is investigating potential security issues. Meanwhile, Tether and Circle have frozen at least $2.316 billion in stablecoins, BTC briefly dropped below $79,000, and liquidations across the network reached $628 million within one hour.

Earlier the same day, prediction market Polymarket一度 suspended new trading after a third-party service provider was compromised, and promised full compensation for affected users.

How It Happened

On-chain data shows the first anomalous transfer occurred at 20:24 UTC: a wallet labeled Binance 14 transferred 167,464 ETH (valued at approximately $388 million by Etherscan) to a newly created address, along with dozens of other tokens including approximately $1.6 billion in USDT. Twenty-four seconds later, Binance 16 transferred another approximately 28,000 ETH to the same address. At around 20:41, a wallet labeled Binance Hot Wallet 34 transferred 780 million USDC to the same recipient, followed by another 43 million USDC at 20:59.

The wallet that initiated these transactions had previously received gas funds of only about 0.1 ETH through Tornado Cash in three separate transfers. Some reports noted that Binance had scheduled Ethereum wallet maintenance on October 28, but there is no evidence yet linking this to the transfers.

Scale of Losses: Total Outflow of Approximately $5.6 Billion; Binance Has Not Disclosed Figures

As of press time, outflows associated with Binance-labeled wallets total approximately $5.643 billion, including $3.528 billion on the Ethereum network, $1.449 billion on Bitcoin, $628 million on Tron, and $38 million combined across Arbitrum, Optimism, and Base.

It should be noted that "outflow" does not equal "theft": Binance has not confirmed which transfers were caused by the attack, nor has it stated whether the frozen portion can be recovered.

As of press time, Binance has not disclosed the total amount.

Stablecoin Freeze: At Least $2.316 Billion Locked

Within about an hour after the incident, Tether and Circle took action successively. CZ initially disclosed freeze amounts of approximately $971 million for Tether and approximately $823 million for Circle, totaling about $1.794 billion. Subsequently, Tether CEO Paolo Ardoino stated that over 1.567 billion USDT had been frozen.

According to on-chain monitoring cited by Odaily, Tether and Circle have frozen at least $2.316 billion in stablecoins.

However, stablecoin issuers can only freeze tokens they themselves issue. Approximately 195,000 ETH (about $450 million) in the receiving address and approximately 16,700 BTC that left Binance wallets are outside the scope of the freeze.

At 05:33 Beijing time, Binance updated its statement saying that user funds are completely safe, and the team has noted reports of potential security issues and is actively investigating, with the security team urgently reviewing all relevant information and will publish updates through official channels once verified. As of press time, Binance has still not publicly confirmed the nature of the incident, nor disclosed the attack method, loss amount, or compensation arrangements.

Market Reaction: $628 Million Liquidated in One Hour, 97% Longs

Coinglass data shows that within one hour, contract liquidations across the network reached $627.7 million, of which longs accounted for $606.6 million, while shorts were about $21 million. BTC liquidations were $189 million, ETH liquidations $157 million, and SOL liquidations $46.8 million; total liquidations across the network over the past 24 hours amounted to approximately $953 million.

Prices of major cryptocurrencies, source: Coingecko

In terms of price, BTC fell below 79,000 USDT to 78,974.5 USDT, down 2.59% in 24 hours; ETH fell below $2,240. BTC and ETH dropped by more than 3% and 4% respectively within an hour after the incident; as of press time, BNB is trading at $703.28, down 6.3% in 24 hours.

Polymarket: Third-Party Service Provider Compromised, Trading Suspended for About an Hour

According to Polymarket's status page, at 2:05 AM Beijing time on October 30, the platform entered cancel-only mode and suspended relayer operations. An hour later, Polymarket said it had identified and fixed the issue on its international site Polymarket.com, stating that a third-party service provider had been compromised, the matter had been referred to law enforcement, and affected users would be "fully compensated." Trading subsequently resumed, and the status page marked the incident as resolved.

Odaily previously reported, citing Bubblemaps monitoring, that in the theft incident triggered by the compromise of Polymarket's third-party service provider, more than 700 users were affected, with approximately $2.7 million in funds stolen.

This is already Polymarket's third security incident this year: in May, an internal operations wallet was compromised due to a private key from six years ago, resulting in a loss of approximately $700,000; on June 25, a third-party vendor was compromised, leading to malicious scripts being injected into the frontend, with approximately $3 million in user funds stolen and fewer than 15 accounts affected, and the platform promised full compensation.

There is currently no evidence indicating that the Polymarket incident is related to the Binance incident.