CIR

Author: Gu Yu, ChainCatcher

At dawn on October 30th, Beijing time, on-chain data showed that a Binance hot wallet marked as Binance 14 transferred 167,464 ETH to an address that had never appeared before, while also taking away 63 tokens, including approximately 1.615 billion USDT. This single transaction was worth approximately $2.5 billion.

40 minutes later, the total outflow given by multiple statistical sources stopped at around $5.8 billion. This figure surpasses the approximately $1.5 billion Bybit theft in February 2025, becoming the largest exchange theft in cryptocurrency history—and it belongs to an exchange with the world's largest security team and the thickest balance sheet.

Just hours ago, Polymarket, a leading prediction market trading platform, suspended trading due to a breach of a third-party service provider. Almost simultaneously, two leading crypto exchanges suspended trading due to hacking attacks, highlighting the extreme severity of the crypto security situation. The preparations for the attack were completed the day before the transfers occurred. From October 28th to 29th, a brand new address received three transactions totaling approximately 0.1 ETH through the mixer Tornado Cash—these were gas fees. Exchanges would never use mixers to pay gas for their own transfers. On-chain analyst Spreek issued the first warning based on this, stating: "This could be routine wallet maintenance, but it looks extremely suspicious." At 20:24 (UTC), the first abnormal transaction occurred. 24 seconds later, a second wallet, Binance 16, transferred 28,005 ETH to the same address. At 20:41, Hot Wallet 34 transferred 780 million USDC; at 20:59, another 43 million USDC were transferred. The entire process was quiet, continuous, and uninterrupted, like an authorized internal transfer. Within 15 minutes, the attacker transferred approximately 195,460 ETH to another new address. This portion is Ethereum; it has no issuer, no switch, and once transferred, it's gone. As of press time, approximately $5.8 billion has flowed out of wallets tagged with Binance: $3.528 billion to the Ethereum network, $1.449 billion to Bitcoin, $628 million to Tron, and $38 million to Arbitrum, Optimism, and Base combined. It should be noted that outflow does not equate to theft, nor does it represent a final loss—Binance has not released any figures, and there is a possibility of misjudgment in on-chain tagging. However, the market reaction preceded the facts. Bitcoin briefly fell below $79,000, Ethereum fell below $2,240, and $627.7 million was liquidated across the network within an hour, of which $606.6 million were long positions, with Binance alone accounting for $344.8 million. BNB once fell 6% to around $710. II. $2.54 Billion Frozen Within an hour of the incident, Tether and Circle took action. Tether CEO Paolo Ardoino stated that over 1.567 billion USDT had been frozen, up from the initially disclosed figure of 971 million; Circle froze approximately 823 million USDC. Binance's verification result on the morning of the 30th was: The total amount of assets currently frozen is $2.54 billion, and this figure may continue to increase as cooperation with law enforcement, issuers, blockchain intelligence companies, and industry partners progresses. This is the most noteworthy structural fact of this incident. USDT and USDC are centrally issued tokens, and the issuer retains the power to freeze any address—the stablecoins stolen by the hackers are most likely locked and immobilized. ETH and BTC, on the other hand, belong to a network without an issuer; no institution can press that button. This leads to an ironic contrast: In this industry, the more "decentralized" the funds, the less likely they are to be recovered after being stolen; the more reliant on a centralized issuer, the safer it is. The responses from all parties form a clear spectrum of perspectives. Binance's official stance was the most restrained: initially, they stated, "We have noticed reports of potential security issues and are investigating; we have not yet confirmed that user funds have been affected." Later, they stated that some users' withdrawals were blocked due to a "technical error" and were being restored. Then, on the morning of the 30th, they changed their statement to, "Security checks are underway, and withdrawals will resume once the security issue is fully resolved," while simultaneously suspending withdrawals and Binance Alpha trading. Co-founder He Yi confirmed that the team is investigating. CZ, who is no longer involved in day-to-day management, put it most directly: "User funds are safe; it seems Binance was indeed hacked. I no longer manage Binance.com, but as a shareholder, I expect all user funds to be fully covered." Regarding the net loss, DefiLlama founder 0xngmi calculated: Binance holds approximately $144 billion in assets; after deducting the frozen stablecoins, the loss is approximately $1 billion, representing 0.69% of the assets under custody. "Binance can easily cover this with its balance sheet." CZ reposted and added: "The loss may be slightly higher than this, but it will be fully covered." This raises another question. Binance's SAFU (Safe Asset Fund), established in 2018, has a publicly disclosed size in the $1 billion range. If the net loss is slightly higher than $1 billion, as CZ stated, then the actual source of the bailout is no longer that fund, but Binance's own balance sheet. The bailout mechanism has changed from "a prepared pool" to "the credit of a company." III. Binance's Third Attack: From $41 Million to $5.6 Billion This is not the first time Binance has been hacked. On May 7, 2019, at block height 575012, a hacker withdrew 7,000 Bitcoins from Binance's hot wallet, worth approximately $41 million at the time, representing 2% of Binance's total Bitcoin holdings. Binance's announcement described the incident in detail: the hacker used a combination of phishing and virus attacks to obtain a large number of users' API keys and Google Authenticator 2FA codes. At the time, CZ said, "Today is not a good day, but we will remain transparent," and the SAFU fund fully covered the loss, with deposit and withdrawal services suspended for a week. On October 7, 2022, a vulnerability was discovered in BNB Chain's cross-chain bridge, Token Hub, allowing attackers to mint 2 million BNB in ​​two separate transactions, worth approximately $566 million. BNB Chain temporarily suspended block production. Going back further, there were two risk control incidents triggered by phishing attacks on API users in March and July 2018. Over seven years, there were three such incidents, with the amount increasing from 41 million to 566 million and then to 5.6 billion. The numbers increased more than a thousandfold, but the target of the attacks remained almost unchanged: each time it wasn't the mathematical key that was breached, but rather the process by which the key was obtained was bypassed. In 2019, phishing attacks stole API keys and 2FA; in 2022, the verification logic of cross-chain bridges was compromised; and this time, on-chain traces pointed to the theft of hot wallet signature permissions. The form changes, but the location remains the same—all at the seam between "people" and "systems." IV. 2026: A Black Year for Exchanges Just hours before Binance's attack, another leading crypto platform had experienced a much smaller attack with an almost identical path. Early on October 30th, prediction market Polymarket issued a statement on its official account: An issue affecting the international platform Polymarket.com had been discovered and fixed; a third-party provider had been compromised, and the incident had been handed over to law enforcement. Out of an abundance of caution, trading was temporarily suspended. Trading was fully restored approximately one hour later. Polymarket stated that anyone affected would receive full compensation. It was not a wallet or a contract that was compromised. According to CNBC and NBC News, the problem stemmed from a hack of DebugBear, a UK-based website performance monitoring and web analytics tool. Polymarket subsequently handed the case over to UK law enforcement. DebugBear also confirmed on its X account that it was experiencing an "ongoing security incident." Polymarket's US platform was unaffected. The scale of the losses is nowhere near that of Binance. Data from blockchain analytics firm Arkham points to approximately $2.65 million; CNBC, citing analysis from Betting Intelligence and Polysights, stated that one account withdrew at least $2.7 million from 710 other wallets. The amount is not large, but the nature is clear: the attackers did not access Polymarket's system; they accessed other software installed on Polymarket's system. On September 24, 2026, Bitget was also hacked, losing approximately $387.5 million. According to the reconstruction by Galaxy Research and BlockSec, the attackers did not obtain the private keys, but instead exploited zero-day vulnerabilities in two third-party security products to obtain internal high-level credentials, inserting forged withdrawal instructions into the wallet backend, and then deleting the traces afterward. Bitget CEO Gracy Chen stated: They did not forge user withdrawal requests, nor did they obtain the private keys of cold or hot wallets. The forged requests were structurally identical to legitimate internal transfers, so the authorization system approved them. The Bybit case in February 2025 was a previous version of the same scenario: approximately $1.5 billion worth of Ethereum was lost when attackers compromised the UI and transaction display interface used by multi-signature signers, making the signers believe they were approving a routine transfer. The private key was secure throughout, and the Safe contract was also fine—the problem was with the screen in front of the key. The FBI attributed it to North Korea. Galaxy Research summarized these two incidents with a statement that could almost serve as an epitaph for the entire industry: "No one attacked the mathematics of the private key; they attacked the person, or system, who told the mathematics what to do." Money laundering is also becoming industrialized. BlockSec tracked approximately $269 million in net inflows into THORChain in the Bitget case; Galaxy stated that THORChain rejected Bitget's request to deny service, citing "decentralization and permissionlessness"—Bybit's funds followed a similar path. When funds flow out of decentralized protocols, recovery is no longer a technical issue, but a matter of perspective. Industry data is equally concerning. SlowMist reported 182 security incidents in the first half of 2026, resulting in losses of approximately $956 million, a 50.41% year-on-year increase in the number of incidents; CertiK reported 344 incidents, totaling $1.316 billion; Hacken reported $1.18 billion in losses in the third quarter, a 55% increase quarter-on-quarter, with 77% related to supply chain blind spots. Sorted by loss amount, Blockaid's statistics show private key and operational security accounting for 74.3% of incidents; sorted by incident number, code vulnerabilities account for 79.3%. In other words: the most common problem is code, but the most fatal flaw is always permissions. Conclusion From approximately $450 million for Mt. Gox, to $1.5 billion for Bybit, and now to the still fluctuating $5.6 billion—the record for the "largest theft in history" is broken every few years, and even three times in the last year. Each time it's broken, the industry is wealthier, more professional, and more compliant than before. This shows that the growth rate of security investments by crypto companies still cannot keep up with the speed of hacking techniques and AI development. Even more noteworthy is the nature of the adversary. The Bybit and Bitget cases were attributed to North Korea's Lazarus by the FBI, Elliptic, and Chainalysis respectively. The Binance case is highly similar in method to these two previous cases. A sanctioned and isolated country is using cryptocurrency exchanges as its most stable source of foreign exchange—and the costs of this business are borne by users worldwide. Binance will likely be able to afford the $1 billion loss; users will probably not lose a penny, and withdrawals will be restored. But from Mt. Gox to Binance, twelve years have passed, and exchanges remain the most vulnerable yet most tempting link in this industry chain; and what has been breached is never cryptography, but rather processes and the supply chain.