Binance probes $6.3B hack, freezes $3B; Polymarket halts trades

Binance is investigating what it calls a "potential security issue" with an estimated impact of about $6.3 billion, and it has already frozen roughly $3 billion of that with blockchain partners. The world's largest cryptocurrency exchange by trading volume said late Thursday that the incident may involve a compromised development operations engineer's laptop, which let an attacker access a service container and submit unauthorized withdrawal transactions. Binance said it found no evidence of any wallet private key leak, and it suspended all deposits and withdrawals as a precaution while its team conducts security checks, freezes funds, and works with law enforcement.

The news landed the same day Polymarket, the world's largest prediction market by trading volume, temporarily halted trading after users reported unauthorized withdrawals. Polymarket said one of its third-party providers was compromised and that the incident had been referred to law enforcement, with trading resumed by 3 p.m. Eastern time. Binance has said it will cover all losses, and founder and former CEO Changpeng Zhao posted on X: "User funds are safe! It does look like a hack on Binance." There is no evidence the two incidents were related.

Binance's response is notable for its speed and its promise. The company said its initial investigation suggested the attack path ran through a development operations engineer's laptop, allowing the attacker to reach a service container and submit unauthorized withdrawal transactions. Binance said it has worked with its blockchain partners to freeze around $3 billion in assets so far, and it added, "Binance will cover all losses." The company did not respond to a request for comment, but the public pledge is a strong signal that it intends to protect user balances even before the full scope of the incident is confirmed.

Stablecoin issuers moved quickly to contain the damage. Tether CEO Paolo Ardoino said on X that the company froze more than $1.5 billion related to the potential Binance hack. Circle CEO Jeremy Allaire said the company froze over $800 million in connection with the incident and that it was coordinating with law enforcement. Combined, that is more than $2.3 billion in frozen assets, a reminder that the modern crypto safety net depends heavily on issuers and exchanges acting in concert during an active incident.

Changpeng Zhao, who no longer manages Binance, framed the situation in shareholder terms. "I don't manage Binance anymore, but as a shareholder, I expect all user funds will be fully covered," he wrote. Zhao also expressed appreciation to Tether and Circle for quickly freezing funds. For users, the message is that Binance is willing to absorb the loss, but for competitors, the episode shows how much trust depends on a single company's willingness to backstop its platform.

Polymarket's incident followed a different pattern. The company said one of its third-party providers was compromised, and a person familiar with the matter attributed the hack to DebugBear, a web performance monitoring platform designed to help businesses optimize website speed. It is unclear exactly how Polymarket uses DebugBear, and DebugBear did not respond to a request for comment. The company did say in an X post that it was aware of a security incident and was treating it as a "top priority." A Polymarket spokesperson told Business Insider that the malicious activity occurred in the UK and that the company will reimburse affected users, though it was unable to confirm the amount that may have been stolen. Polymarket's US exchange was not halted and did not appear to be affected.

For every platform holding user funds, these two incidents expose the same core vulnerability: the attack surface extends beyond core infrastructure into third-party vendors and internal engineering endpoints. Binance's rapid freeze and coverage pledge, combined with Tether and Circle's coordinated action, sets a new visible benchmark for incident response. Peers in crypto and beyond should watch how the investigations conclude, because the playbook for handling a potential $6.3 billion breach, and the expectations it creates, will shape how users, regulators, and counterparties judge every other exchange.