Binance Hack Reports Escalate as Billions Are Tracked

By Matt Brienen

Published: 2026-10-29T22:00:43.199+00:00

A Rapidly Expanding Security Story

Binance is investigating a potential security incident after reports of billions of dollars leaving exchange-linked wallets on October 29. CoinDesk’s updated report, timestamped 5:50 p.m. Eastern, put holdings in the tracked account above $5.7 billion, substantially beyond the figures circulating earlier in the afternoon.

That is a reported onchain valuation, not an independently verified final loss. CoinDesk quoted Binance saying its teams were investigating a potential security issue. It also quoted founder Changpeng Zhao saying the activity looked like a hack and that, as a shareholder who no longer manages the exchange, he expected customer funds to be fully covered.

The distinction matters: an investigation, a founder’s expectation, and a completed reimbursement are different stages. The available evidence does not yet establish the attack method, a final net loss, or how any customer compensation would work.

Why the Numbers Keep Changing

Earlier reporting from Bloomingbit described approximately $2.77 billion moving from Binance-linked wallets across five blockchains, while emphasizing that theft had not yet been confirmed. Large movements can be observed before investigators establish who controlled the destination or whether every transfer belongs to the same incident.

An address balance, gross transfers, frozen assets and unrecovered losses answer different questions. Adding them together would risk counting the same funds more than once. Token prices and the set of addresses being monitored can also change a running valuation.

CoinDesk reported that Bitcoin fell about 2% over an hour to $78,800, ether fell 3%, and BNB fell 6%. Those figures are snapshots from its report, not current quotes. They show a sharp market reaction without proving that the incident caused every move.

Stablecoin Freezes Could Limit the Damage

A supplied screenshot attributed to Circle chief executive Jeremy Allaire says the company froze more than 800 million USDC associated with the potential Binance exploit while coordinating with law enforcement. A second screenshot attributed to Tether chief executive Paolo Ardoino says more than 1.567 billion USDT was frozen in connection with a potential Binance exchange hack.

The original posts behind those two screenshots could not be independently retrieved for this article. Their figures should therefore be treated as attributed claims rather than a reconciled recovery total. Together, the stated amounts exceed 2.367 billion stablecoin units, but that arithmetic does not establish how much was stolen or returned.

A freeze can restrict movement of affected tokens. It is not the same as returning assets to their rightful owners, and it does not automatically recover other cryptocurrencies. The important next evidence is which addresses were restricted, which balances overlap with the suspected transfers, and what recovery process follows.

Polymarket and DebugBear Are a Separate Thread

The other supplied screenshots concern Polymarket. In one, CZ describes what appears to be a front-end injection attack in response to reports of unauthorized Polymarket withdrawals. In another, DebugBear warns of a security incident and tells customers using its real-user-monitoring product to remove its embedded code.

Reuters separately reported that Polymarket restored trading after a temporary halt, said it had fixed an issue involving a third-party provider, and pledged to reimburse affected traders. A source familiar with the matter identified that provider as DebugBear.

Hudson Rock researchers documented wallet-draining code retrieved from a DebugBear-hosted script and found Polymarket build metadata recording the script’s removal. Their analysis explicitly left the initial compromise mechanism, total attributable losses and any broader impact on other DebugBear customers unresolved.

This evidence does not establish that DebugBear caused the Binance incident. A same-day security event and a shared discussion on social media are not enough to connect two attacks.

The Security Lesson and What Comes Next

The Polymarket findings illustrate why a legitimate website address is not a complete security guarantee. Third-party code running inside an authenticated trading page can become part of that page’s security boundary. That is a different failure mode from an attacker obtaining an exchange wallet’s signing keys, and Binance’s cause still needs to be established.

For Binance, the next meaningful disclosures are a confirmed scope of affected wallets, a technical explanation, the status of deposits and withdrawals, and a clear account of how customer balances are protected. An asset total alone cannot answer those operational questions.

For the wider market, the recovery effort is as important as the headline number. Fast coordination can limit what an attacker can move, but confidence ultimately depends on verifiable containment, transparent accounting and completed restitution. Until those details arrive, this remains a developing story with substantial reported exposure and an unresolved final outcome.