What Happened on October 29, 2026? Polymarket and Binance Hacked the Same Day
⚠ After Oct 29 breaches: check your wallet free — read-only, 30 seconds →Answer: Yes — a hijacked DebugBear script drained $2.64M from 726 Polymarket wallets in 52 minutes (17:10-18:02 UTC) on October 29, 2026; refunds of $3.9M began the next day.
On October 29, 2026, two of the largest crypto platforms were breached within hours of each other. Polymarket’s international site lost approximately $2.64 million from 726 accounts after a third-party monitoring script was compromised and turned into a browser-side drainer on the legitimate polymarket.com domain. Binance lost an estimated $6.3 billion from hot wallets across nine or more blockchains — the largest exchange theft on record, surpassing the $1.5B Bybit hack of 2025. Neither incident broke smart contracts. Both ran through vendor software and human-operated infrastructure, which is exactly why the response for ordinary users is the same in both cases: assume the website, not the chain.
What happened to Polymarket on October 29?
A compromised DebugBear real-user-monitoring script served drainer code inside the genuine polymarket.com page, draining roughly $2.64M from 726 accounts in 52 minutes before trading was halted.
| Detail | Verified figure |
|---|---|
| Date and time | October 29, 2026; malicious build timestamped ~1:59 p.m. ET |
| Vector | Third-party vendor script (DebugBear RUM) turned into a browser drainer |
| Platform response | Trading halted to cancel-only mode within the hour, then restored |
| Losses | ~$2.64M (28.6M POL + positions) from 726 accounts across 33 source wallets, one attacker wallet, 17:10-18:02 UTC |
| Remediation | $3.9M total refunds: $2.64M returned to the 726 drained wallets (689 paid by Oct 30) + $1.19M to ~5,500 affected by the pause; case referred to UK law enforcement |
The structural lesson repeats June’s incident: in both 2026 Polymarket breaches, the on-chain contracts held. Users signed what the compromised page asked them to sign. The attack surface was trust in a URL, and the URL was real.
What happened to Binance on October 29?
Binance confirmed a security incident with an estimated impact of $6.3 billion, drained from hot wallets across nine or more blockchains in under four hours — the largest cryptocurrency theft to date.
| Detail | Verified figure |
|---|---|
| Date | Night of October 29–30, 2026 |
| Entry point | Initially attributed to a compromised DevOps engineer’s laptop; additional breach points later identified |
| Scale | ~$6.3B across Ethereum, Bitcoin and other networks; ~$3B reported frozen with partners |
| Attribution | Suspected North Korea-linked group (TraderTraitor), per BBC and Meduza reporting |
| Platform response | Withdrawals paused during investigation; trading later resumed |
Binance’s own guidance after the incident was the same message every security researcher repeats: be wary of unofficial links, messages, and any request for account details — scam waves always follow a headline breach.
Refund tracker: who has been made whole?
| Refund component | Status as of November 1 |
|---|---|
| Drained wallets (726) | $2.64M returned; 689 of 726 fully repaid by October 30 morning |
| Pause-affected wallets (~5,500) | $1.19M allocated for losses during the trading halt |
| Total refund commitment | $3.9M — more than the amount stolen |
| Claim requirement | None for the 726; status-page form for discrepancies only |
Two numbers matter for anyone tracking this case. First, the refunds exceed the theft: Polymarket is paying $3.9M against a $2.64M drain, covering both the drained funds and the trading-pause losses. Second, the pace: 689 of 726 drained wallets were made whole within roughly 36 hours of the incident — faster than any prior crypto-platform refund process this year.
Why both attacks bypassed the blockchains?
Both breaches ran through vendor software and human-operated infrastructure — a monitoring script and a developer laptop — so no on-chain defense would have fired; user-side session security and approval hygiene are what actually contained losses.
The pattern across both incidents and Polymarket’s June 2026 hack is now well-documented: attackers compromise a supplier or an operator, then use legitimate platform surfaces to reach users. Hardware wallets, smart-contract audits, and exchange proof-of-reserves do not touch this layer. What does:
- The page you trust can be the attack. A real domain with an injected script is indistinguishable from a phishing page without inspection.
- Session theft beats key theft. Both attacks exploited live, authenticated sessions — logged-in users on Polymarket, privileged access at Binance.
- Approvals outlive breaches. Anything you signed before October 29 remains valid after it. Old approvals are standing invitations.
What should Polymarket users do now?
Polymarket users should verify their wallet for unexpected transactions or approvals, revoke any allowances they do not recognize, move remaining balances to a fresh address if anything looks wrong, and rely only on official in-app announcements for refund procedures.
Check your wallet history first. The October 29 drainer liquidated positions and moved assets through normal-looking transactions. Open your address on Polygonscan and look for transfers you did not make during the incident window.
Revoke what you don’t recognize. Active token approvals persist after a breach. The revoke approvals guide walks through reading your live allowances and clearing them; the EIP-7702 delegation checker covers the newer delegation surface where a whole account can be pointed at a contract.
Use the security check on this page. You can verify your wallet’s delegation status directly below — connect read-only and see what your address is pointing at before deciding whether anything needs to be moved.
Wait for official refund instructions. Polymarket pledged full reimbursement and published the procedure on its own channels. No legitimate refund process asks for a seed phrase, an upfront fee, or a signature on a “claim” — the December 2025 and June 2026 incidents both spawned copycat recovery scams within days, and this one will too.
What should Binance users do now?
Binance users should confirm their account is intact via the official app only, treat withdrawal-resumption announcements as the only signal that matters, and prepare self-custody hygiene in case they choose to reduce exchange exposure after the incident.
- Check account activity in the official app — not through emailed links. Phishing campaigns piggyback on breach news within hours.
- Review API keys and withdrawal allowlists. A breach of operational systems is the moment to assume third-party integrations may be exposed.
- Decide on exposure deliberately. “Not your keys, not your coins” is a slogan, but after a $6.3B theft the question of how much to keep on any centralized platform deserves an actual answer. If you move funds, verify addresses against a saved copy — clipboard hijackers spike after every headline breach.
- Expect scam waves. Fake “compensation claims,” fake support agents, and lookalike domains appear within days of every major theft. The 12-type scam catalog applies to exchange users identically.
What the two hacks change for prediction-market users?
The double breach confirms that frontend and operational trust — not chain-level security — is the dominant loss vector for retail users, so session hygiene, approval revocation, and address verification are the controls that matter most in practice.
For prediction markets specifically, the October 29 Polymarket incident is the second frontend supply-chain attack in four months. Users of Polymarket, Kalshi, and every exchange in the category should treat three habits as baseline:
| Habit | Protects against | Effort |
|---|---|---|
| Revoke stale approvals monthly | Drainers reusing old allowances | 10 minutes |
| Verify addresses first-and-last 6 chars | Clipboard-hijacker swaps | Seconds per transfer |
| Sign nothing during incident windows | Bait approvals dressed as “security checks” | Discipline |
The first 24 hours guide covers the emergency sequence if something has already happened; the hack timeline tracks every confirmed incident on the platform to date.
FAQ
Q: Is Polymarket safe to use after the October 29 hack? A: Trading resumed the same day after a cancel-only pause, affected users are being reimbursed, and the smart contracts were never compromised. The residual risk is the same as before the incident: third-party frontend dependencies. Users who keep approvals minimal and verify what they sign carry far less exposure.
Q: Was my Polymarket account affected? A: 726 accounts were drained in the incident window on October 29. Check your wallet address on Polygonscan for transactions you did not make. If you find any, follow the first 24 hours sequence and use Polymarket’s official refund channel.
Q: How much did the Binance hack lose in total? A: Binance estimated approximately $6.3 billion in unauthorized transfers, with about half reported frozen in cooperation with partners in the days after. It is the largest cryptocurrency theft on record.
Q: Did the Polymarket hack involve seed phrases? A: No. The drainer worked through authenticated browser sessions and what users signed on the page. No legitimate recovery process will ever ask for your seed phrase — anyone who does is running the follow-up scam.
Q: Should I move funds off exchanges after the Binance hack? A: That is a personal risk decision, not a rule. The incident demonstrates that custodial platforms carry operational risk independent of market risk. If you reduce exposure, move to an address you control and verify the destination address character-by-character.
Sources
- CNBC — Polymarket outage on international exchange, trading halted
- BleepingComputer — Polymarket halts trading after crypto-draining script breach
- FinanceFeeds — Polymarket restores trading after ~$2.64M drained from 726 accounts
- Wikipedia — 2026 Binance hack
- TechCrunch — Binance pauses withdrawals amid suspected multi-billion theft
- Bloomberg — Inside the Binance hack: rogue code, test runs, and no sleep
Disclaimer
This article is independent security research and not financial advice. Figures are drawn from platform statements and contemporaneous reporting as of November 1, 2026, and may be revised as investigations continue. Verify all account-specific actions through official platform channels only.