Binance and Polymarket Incidents: October 2026 Status

By Dana Kovac · Published 2026-10-30 · Updated 2026-11-01 · Independent review — not affiliated with any exchange

Two separate security events hit major crypto platforms on Thursday, October 29, 2026, in US Eastern time. At Binance, wallets labeled as its hot wallets sent billions of dollars to a single new address, and the exchange paused withdrawals on several networks. At Polymarket, a compromised third-party script was used to drain some logged-in users. This page tracks what is confirmed, what is still open and where to check status. It will be updated as Binance and Polymarket publish official findings.

Latest Status (Updated November 1, 2026)

November 1 summary: Binance has begun a phased withdrawal restart. Its latest recovery update scheduled the first phase for 06:00 to 09:00 UTC on November 1. As of our check at 1 November 2026, 19:31 Taipei time (11:31 UTC), Binance’s network status page showed withdrawals open on 12 networks, for at least some assets on each: Bitcoin (BTC), Ethereum (ETH, USDT, USDC), BNB Smart Chain (BNB, USDT, USDC), XRP Ledger (XRP), Base (ETH, USDC), Dogecoin (DOGE), Optimism (ETH, USDT, USDC), Arbitrum (ARB, ETH, USDT, USDC), Tron (TRX, USDT), Solana (SOL, USDT, USDC), Polygon (POL, USDT, USDC) and Avalanche C-Chain (AVAX, USDT, USDC), while TON, Sui and Zcash from phase one were not yet on Binance’s list of reopened networks. Deposits work normally. New developments since October 31:

• Recovery Update #3 (October 31): in Security Incident Recovery Update #3, Binance said the amount covered rose from about 80% to 90% of the impacted amount. It says BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are now fully backed at 100%, and that the remaining 10% consists of less liquid tokens outside that list, which it is still buying through market and OTC channels.
• Where the money came from: the same update lists three sources: a partial deployment of the Secure Asset Fund for Users (SAFU), a portion of the Futures insurance fund, and Binance’s own corporate treasury. Binance says it will top SAFU back up to about $1 billion.
• Reserve snapshot and timing of the full proof: Binance took a new proof-of-reserves snapshot at 00:00 UTC on October 31. It says the full zero-knowledge proof takes about 40 to 50 hours to generate and is expected by Tuesday, November 3 (UTC), later than the Monday date it gave earlier. Our proof-of-reserves comparison explains what to check when that report appears.
• Withdrawal restart: Binance’s Recovery Update #4, published on binance.com on November 1 at 04:08 UTC, says the first phase covers BTC, ETH, BNB, TRX, SOL, XRP, ZEC, DOGE, TON, POL, AVAX, ARB, Base, OP and SUI networks and assets. Other assets and networks follow once security and stability checks are done, and early attempts may be delayed or fail because of traffic.

When withdrawals reopen, expect it to happen one coin and network at a time. Check the withdrawal screen for your exact asset and network, send a small test amount first, and follow our Binance withdrawal guide. Be careful with messages offering “compensation” or “priority withdrawal” links; Binance has asked users to rely only on official channels. On November 1, Binance co-founder Yi He said in a personal post on X that there is currently no cash voucher or compensation campaign, so treat any “compensation”, “airdrop” or “claim your reward” link as phishing unless it appears in an official announcement on binance.com.

Earlier updates (October 31)

October 31 summary: Binance withdrawals were still paused as of our check on October 31 (05:00 UTC). Binance said it would cover the roughly $6.3 billion loss with company funds. New details from October 30 and 31:

• Second official update: at 19:58 UTC on October 30, Binance co-CEOs Yi He and Richard Teng published Security Incident Update #2 in a Binance announcement. It dates the compromise of the hot wallets to around 20:05 UTC on October 29 and puts the loss at approximately $6.3 billion in token assets.
• Withdrawal timing: the same update says the tech team “targets to start resuming the withdrawal service within approximately 34 hours, subject to the completion of security checks,” and that the restart will be phased. Earlier on October 30, Richard Teng said in a video statement reported by CoinDesk that Binance hopes to resume withdrawals by Sunday, November 1. TokenPost noted that this is a target, not a guarantee, because testing must pass first.
• How the attack worked: Teng said there were breach points beyond the employee laptop, and that the attackers used Ethereum’s EIP-7702 account-delegation feature to take control of a hot wallet without going through Binance’s normal approval steps, according to CoinDesk. Update #2 says Binance has still found no evidence that wallet private keys leaked, and expects to share technical findings within about 48 hours.
• Covering the loss: Binance has reserved more than $6.34 billion, of which $5 billion is already held in the affected tokens. Update #2 describes this as roughly 80% of the affected amount, with the rest being bought through market and OTC channels. About $3 billion remains frozen on-chain.
• Proof of reserves: Binance planned an initial snapshot within 12 hours of Update #2 and says results will be ready by Monday, November 2. Our proof-of-reserves comparison explains what such a report can and cannot show, and user protection funds vs proof of reserves covers how a SAFU-style fund differs from a reserve audit.
• Why hot wallets were exposed: exchanges keep a working balance online so withdrawals can be processed quickly. Our explainer on hot wallet vs cold wallet security covers why that balance is the usual target.

Binance’s later recovery update replaced the October 31 timing above; see the November 1 summary.

Earlier updates (October 30)

Binance published a preliminary investigation notice on October 30 at 02:25 UTC, in a Binance announcement and on its official X account, as reported by Reuters and CNBC. Key points:

• Withdrawals: still paused. At 04:36 UTC on October 30, Binance said on its official X account that withdrawals “remain paused while our team completes a security revamp of the withdrawal service and its related addresses” and that it expects to resume “within 48 hours.” In an investigation update on its official X account at 08:47 UTC on October 30, Binance said it is “still on track towards the expected timeline to resume the withdrawal service in 45 hours” and that “the outflows ceased when we paused withdrawal service earlier.”
• Deposits: operating normally, according to the same 04:36 UTC post. Binance’s 02:25 UTC notice listed a temporary suspension as a precaution while security checks were completed, and said it had revoked the affected address authorisation. In its 08:47 UTC update, Binance again said “Deposits remain unaffected.”
• Suspected cause: Binance says its “initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop,” which gave access to a service container used to submit unauthorized withdrawal transactions. Binance says it has “found no evidence of any wallet private key leak.” This is a preliminary finding; a detailed technical post-mortem is promised. In its 08:47 UTC investigation update, Binance said the compromised laptop was not the only entry point: “our subsequent investigation has uncovered additional points of breach.” It called this “a complex attack,” said it is working with law enforcement, and said it is “still gathering the facts.”
• Estimated impact: “around $6.3B,” according to Binance. Separately, Chainalysis estimated about $5.912 billion stolen, according to CoinDesk.
• Frozen funds: ”~$3 billion frozen on-chain so far,” per the same notice. This supersedes the earlier $2.54 billion verified total Binance gave on its official X account at 23:22 UTC on October 29.
• Losses: “Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe.” Binance says it will publish an updated proof of reserves once remediation is complete.
• Recovery of user assets: at 10:55 UTC on October 30, Binance said on its official X account that it “has begun recovering affected assets for users” and “has already reserved over $6.34B of company funds to cover this incident.” Binance said $5 billion of that is already held in the exact tokens that were affected, and that it is buying the rest through market and OTC channels, which “can take longer because some tokens may have low liquidity and OTC settlement also takes time.” Binance said these figures do not include the roughly $3 billion frozen, and that “ultimately, all user funds will be verified publicly through our Proof of Reserves.”
• Reopening: not yet as of October 31; see the summary above. At 02:32 UTC on October 30, co-founder Yi He said on X, in a personal post, that Binance will enable withdrawals as soon as the security scan is complete. Binance has not announced that withdrawals have reopened.
• Binance Alpha: according to media reports, at 23:06 UTC on October 29 Binance said Binance Alpha trading “has been temporarily suspended” and “will resume once the security issue is resolved,” according to FinanceFeeds. On October 30 at 07:49 UTC, Binance’s official support account (Binance Help Desk) said Binance Alpha trading remains suspended and will resume once the security issue is resolved.
• Polymarket: trading resumed after about an hour in cancel-only mode; the company says affected users will be made whole.

What Binance Has Said So Far

Binance’s wording shifted over the evening, so each quote below is tied to the outlet that reported it:

In the same statement to TechCrunch, Binance said it would post updates “through official Binance channels” and warned users not to trust “unofficial links, messages, or requests for account information.” Changpeng Zhao, who no longer runs the company, wrote that “as a shareholder, I expect all user funds will be fully covered,” according to FinanceFeeds. On October 30, co-founder Yi He said on X, in a personal post rather than a company announcement, that “Binance will cover all hacking losses,” and Binance’s official notice later that day said losses will be covered “from the SAFU fund and the company’s funds.” For first-party updates, check the Binance announcements page.

Can You Withdraw From Binance Right Now?

November 1 update: see the latest status section above. Binance has scheduled a phased restart from 06:00 UTC on November 1, starting with 15 networks and their main assets, so check the withdrawal screen for your exact coin and network. The October 29 and 30 details below are kept for reference.

Binance’s official notice at 02:25 UTC on October 30 kept withdrawals suspended; at 04:36 UTC Binance said deposits operate as normal, while withdrawals remain paused with resumption expected within 48 hours. At 08:47 UTC Binance said it is still on track to resume withdrawals in 45 hours. The earlier, network-by-network picture from October 29 is kept below for reference. The table below is based on media reports, not on a Binance announcement: CryptoTicker read Binance’s own deposit and withdrawal status interface at 22:32 UTC on October 29 and reported the following.

CryptoTicker reported that Binance showed a wallet maintenance note on the paused networks and had not said whether those pauses were linked to the incident. Before sending anything, open the withdrawal screen itself and confirm the network you want is open, and that your destination wallet supports the same network. Our step-by-step Binance withdrawal guide covers network choice and how to check official status, and what to do if you sent crypto on the wrong network explains why a mismatch is so costly.

How Stablecoin Issuers Froze Part of the Funds

Tether CEO Paolo Ardoino said Tether froze “more than 1.567B USDT,” and Circle said it froze more than 800 million USDC “in coordination with law enforcement,” according to FinanceFeeds. Binance co-founder Yi He said on X, in a personal post, that Ripple helped stop roughly $200 million.

A freeze is not a recovery. Frozen tokens stay locked at the address until issuers, investigators and the exchange agree on next steps. Assets such as ETH cannot be frozen this way, and Unchained reported that some non-freezable tokens were moved onward.

What Happened at Polymarket?

Polymarket’s status page shows the exchange in cancel-only mode from 6:05 p.m. to 7:05 p.m. UTC on October 29. In its update, Polymarket said “one of our third party providers was compromised,” that it had referred the matter to law enforcement, and that “anyone who has been impacted will be made whole.”

BleepingComputer and CNBC identified the provider as DebugBear, a website performance monitoring service whose JavaScript runs inside customer websites. According to BleepingComputer, the malicious script checked whether a visitor was logged in and then tried to sell positions or transfer tokens to an attacker-controlled wallet; it traced about $2.5 million to a suspected attacker wallet. CNBC reported that Polymarket told users in Discord that those who lost less than $10,000 would have funds restored by October 30, and the US platform was reported unaffected. Polymarket had not published an official loss total. If you plan to move funds off the platform, our Polymarket withdrawal guide covers token and network choice.

Should You Spread Funds Across Platforms?

Neither incident makes any platform risk-free, and both show why it helps not to keep everything in one place: one failure then cannot freeze all of your money at once. We cover how to size balances across exchanges and wallets in why diversify across crypto exchanges, so this page stays focused on the incidents. In the meantime, avoid panic transfers on paused or unfamiliar networks, send a small test amount first, and log out of web apps when you are done, since the Polymarket script relied on an existing logged-in session.

For how earlier incidents played out after the first headlines, see what happens when an exchange gets hacked and our list of the biggest exchange hacks.

Dana Kovac — Covers trading tools, bots and market structure. Spent four years on a prop trading desk before going independent.