Binance: CZ points to a hack as Polymarket confirms a compromised provider

Binance: CZ reports stablecoin freezes

Changpeng Zhao said on Thursday, October 29, that the suspicious movements observed at Binance looked like a hack. In his original post, reviewed by Nexorena, the founder thanked Tether and Circle for quickly freezing approximately $971 million and $823 million, respectively. He said user funds were safe, while noting that he no longer runs Binance. His statement that customers should be fully covered therefore represents a shareholder’s position; by itself, it is neither a technical assessment nor a detailed compensation process.

An initial post from Binance’s official account said its teams were investigating a potential security issue and had not at that point confirmed any impact on user funds. Cryptoast also reported large transfers from an Ethereum wallet identified as belonging to Binance. Published estimates changed throughout the evening, with different scopes depending on the networks and assets included. Treating the gross amount as a final loss would erase an essential distinction between observed transfers, frozen funds, and money that is actually unrecoverable.

Polymarket: a compromised vendor and a trading pause

Polymarket described a separate incident on its international platform. In its status-page history, the company said it had identified and fixed an issue involving a compromised third-party provider. It said it had referred the matter to the relevant authorities and promised to make everyone affected whole. Trading was temporarily limited to order cancellations, while relayer actions were suspended. This measure prevented new operations during the investigation without meaning that every technical service was unavailable at the same time.

Hudson Rock researchers separately examined a script associated with a website performance-monitoring integration. Their static analysis identified code seeking access to trading context, selling positions, and redirecting assets. They also found a reference to the integration’s removal in the metadata of a production build. That work supports the existence of malicious functionality in the file examined; the researchers do not present it as a complete reconstruction of every victim’s transactions.

Preliminary totals and two separate investigations

Amounts discussed in connection with Binance should not be added to the estimates circulating about Polymarket. A balance visible at a suspicious address does not establish that all of that money comes from the same incident either. A stablecoin freeze blocks movements under the issuer’s rules; it does not demonstrate that funds have already been returned to customers. Protection or compensation announcements must therefore remain distinct from repayments that have actually been completed and documented.

At our latest check, Polymarket’s status page showed its services as operational. That technical recovery does not close the investigation into the number of affected people or the final financial impact. For Binance, the posts reviewed do not yet provide a complete report establishing the cause and total net losses. None of the evidence verified here demonstrates that the two incidents share the same origin. This news update will be corrected if the companies publish more precise conclusions.