Brief · Builders

Binance Paused Withdrawals, Polymarket Blamed a Vendor

By alkizz · Oct 29, 2026

Two big crypto incidents landed on the same Thursday afternoon, and the internet has already decided what happened in both. The companies haven't. No source links the two, and the reported methods are different, so here's what's confirmed, what's only reported, and what to do tonight.

Binance: confirmed "potential security issue," no root cause

Binance says its teams are "aware of reports of a potential security issue" and investigating, and a later version of that statement says "user funds are completely safe." A Binance spokesperson told TechCrunch that Binance "temporarily suspended withdrawals on multiple networks following a security incident as a precautionary measure." Co-founder Yi He says withdrawals are "currently disabled until the environment is confirmed to be secure." Binance hasn't called it a hack, hasn't given a root cause and hasn't published a loss figure, and as of 6:52 PM ET there was nothing in its official Announcements feed.

What's reported, not confirmed by Binance:

• How much left. Trackers disagree. Blockaid, per PANews, says it's investigating about $3.3B of suspicious outflows (Ethereum, Arbitrum and Avalanche), Decrypt's tally is "at least $5.57B" across Ethereum, Bitcoin and Tron, and CNBC, citing Arkham, says "nearly $6 billion." Arkham's numbers are holdings in a wallet cluster, not verified theft, so treat the whole range as unconfirmed.
• How it moved. Unchained and Decrypt report that an address funded through Tornado Cash set an EIP-7702 delegation on the hot wallet Etherscan labels "Binance 14," minutes before one large transaction moved funds out. That delegation only works if it's signed with the wallet's own key. The transaction carried 50 of them, one per possible nonce, and one landed, which Blockaid said meant the attacker "didn't know Binance 14's live nonce." Four minutes later it swept about 167,464 ETH, 1.6B USDT and 63 other tokens. Decrypt says how the attacker got the required signature is "still unknown," so anyone calling it a stolen key or a tricked signer is guessing.

The freezes are on firmer ground. Tether CEO Paolo Ardoino says Tether froze "more than 1.567B USDT," and Circle CEO Jeremy Allaire says Circle froze more than $800M in USDC. On-chain reads show about 1.18B USDT and 823M USDC frozen on the attacker's main address, about $2B, plus roughly 200M USDT on smaller wallets. Nobody has publicly traced the rest of Tether's figure, so don't add the numbers up.

Polymarket: a third-party script in a logged-in session

This one is confirmed by the company, at least partly. Polymarket's status page says "one of our third party providers was compromised," trading went to cancel-only mode at 2:05 PM ET, was halted after the 2:37 PM ET update, and resumed around 3:05 PM ET, and "anyone who has been impacted will be made whole." Polymarket hasn't named the provider or a loss total.

Everything past that is reported. A person familiar with the matter told CNBC the provider was DebugBear, a web-performance monitoring service, and Hudson Rock found the malicious JavaScript on DebugBear's CDN. DebugBear itself says it's "impacted by an ongoing security incident" and tells customers to remove its RUM embed code, but it hasn't named Polymarket either. Per BleepingComputer's analysis, the script took over logged-in sessions, read the stored trading API credentials from the browser, and used the page's own signer to sell positions or move funds to the attacker. Security Boulevard found no code that sends a private key or seed phrase, because it didn't need one. Loss estimates run from about $2.19M (Hudson Rock) to at least $2.7M (CNBC, citing Betting Intelligence and Polysights), and Bubblemaps, per WIRED, reported about 700 users appear affected and about $2.7M stolen. None of them is official.

Other exchanges

We found no report of a new Bybit incident as of 7 PM ET Oct 29; Bybit's own announcements page couldn't be checked from here. The Bybit coverage going around is recycled from its February 2025 theft. Bitget suspended TRX withdrawals at 6:47 PM ET "due to wallet maintenance," and nothing links that to Binance. Swyftx's status page showed all systems operational as of about 6:53 PM ET.

What to do:

• If you're a Binance user, don't move money because a message told you to.

  • Why: withdrawals are paused and people are nervous, which is exactly when "recovery" and "verify your account" phishing shows up.
  • How: Binance itself warns users not to trust unofficial links, messages, or requests for account information. Get updates only from Binance's official site, app and accounts, ignore links in DMs, texts and emails, and never hand over account details to anyone offering help.

• Check your own wallet's delegations and approvals.

  • Why: an EIP-7702 delegation keeps working after it's set, and that's the reported mechanism here, whatever the root cause turns out to be.
  • How (my suggestion): look up your address in your wallet or a block explorer, revoke any 7702 delegation you didn't set on purpose, and revoke token approvals you no longer use. If you run hot wallets, add that check to your monitoring.

• If you used polymarket.com on Oct 29, check your account.

  • Why: the script sold positions and moved funds from logged-in sessions.
  • How: look for sales or withdrawals you didn't make. CNBC reports reimbursement terms Polymarket shared on Discord, which we haven't seen directly.

• If you run a site with logged-in users, treat third-party scripts like code with your users' keys.

  • Inventory every third-party script on authenticated pages, and remove DebugBear RUM if you use it (DebugBear's own advice).
  • General good practice, not advice from Polymarket or DebugBear:
    • Keep analytics and monitoring scripts off pages that handle sessions, keys or signing.
    • Use Subresource Integrity on scripts you pin, and a Content Security Policy that limits where scripts load from and send data to.
    • Don't keep signing keys or long-lived API credentials in browser storage.
    • Scope sessions to what they need and make them expire.

Sources

• Unchained via Yahoo Finance: Binance says user funds "completely safe"
• Unchained: Binance says user funds are completely safe
• CryptoTicker: How much USDT is really frozen
• The Block: Binance investigating hack
• TechCrunch: Binance pauses withdrawals, warns users about scams
• Coindoo: Yi He on withdrawals
• Decrypt: Binance outflows, EIP-7702 delegation, Tether and Circle freezes
• CoinDesk: Binance outflows, Ardoino and Allaire statements
• CNBC: Circle and Tether freeze funds
• PANews: Binance outflow timeline
• The Defiant: Binance-labeled wallet swept minutes after EIP-7702 delegation
• BigGo Finance: Binance 14 sweep amounts and timing
• Etherscan: Binance 14
• Polymarket status page incident
• CNBC: Polymarket halts trading
• BleepingComputer: Polymarket crypto-draining script
• Hudson Rock / InfoStealers: wallet-draining code in a third-party script
• Security Boulevard: dissecting the Polymarket malicious JavaScript
• WIRED: Polymarket halted international trading after accounts were drained
• Bitget: TRX withdrawal suspension
• Swyftx status

← All briefs