The cryptocurrency industry faced a major security crisis on Thursday after reports of separate cyberattacks targeting Binance and Polymarket triggered sharp market declines and renewed concerns over the vulnerability of digital asset platforms.
The reported incidents involved billions of dollars in cryptocurrency, with blockchain analysts identifying wallets allegedly linked to attackers holding assets worth more than $5.7 billion in connection with the Binance incident. Polymarket, meanwhile, temporarily suspended trading after a security breach involving an external service provider.
The turmoil began with reports that Binance, the world’s largest cryptocurrency exchange by trading volume, had suffered a major security breach. Initial estimates indicated that approximately $600 million in cryptocurrency liquidations occurred across exchanges within an hour as traders moved to reduce their exposure amid uncertainty.
Subsequent blockchain analysis suggested that wallets allegedly associated with the attackers had received more than $5.5 billion in digital assets. Later estimates placed the figure above $5.7 billion across several cryptocurrencies, including Bitcoin, Ether, USDT and USDC. The reported scale raised the possibility that the incident could become the largest cryptocurrency theft on record, although the full extent of the breach remained under investigation.
The market reaction was immediate. Bitcoin fell below $80,000, while Binance Coin (BNB), the exchange’s native token, also recorded a sharp decline. Other major cryptocurrencies suffered losses as investors responded to concerns about the security of a platform central to global digital asset trading.
Changpeng Zhao, the founder of Binance, known widely as CZ, said the available information appeared to indicate that the exchange had been hacked. Although no longer involved in its day-to-day management, Zhao expressed hope that all customer funds would ultimately remain protected.
Binance sought to reassure users, stating that customer assets were secure and warning investors to remain alert to scams and phishing attempts associated with high-profile security incidents. The exchange also temporarily suspended several Binance Alpha services, including CEX Buy Token, Alpha Instant and predictive trading-related functions linked to spot wallet funds.
As the investigation continued, Binance announced that approximately $2.54 billion worth of assets had been frozen through emergency security measures. The company said it would release only verified information as investigators worked to establish the full circumstances of the incident.
A separate attack targeting Polymarket added to the disruption. The prediction market platform suspended trading operations for nearly an hour after identifying a security incident involving an external service provider.
Preliminary reports suggested that attackers may have exploited a vulnerability connected to DebugBear, a third-party performance and analytics tool used by the platform. The alleged breach was estimated to have resulted in the theft of between $2.65 billion and $2.7 billion in cryptocurrency from user wallets, although the precise losses remained unconfirmed.
Polymarket notified British authorities after preliminary information suggested that the operation may have originated in the United Kingdom. Users also reported missing funds and emptied wallets through community channels, raising concerns about the security implications of platforms relying on external software providers.
The company subsequently restored operations and pledged to compensate affected users for all verified losses. The commitment was intended to address concerns among traders following the disruption.
The two incidents have renewed scrutiny of cybersecurity protections across the cryptocurrency industry, particularly the risks associated with exchange infrastructure, digital wallets and third-party service providers. If the reported figures are confirmed, the Binance incident would exceed previous cryptocurrency thefts in scale.
As investigations continue, the extent of the losses, the methods used to carry out the attacks and the number of affected users remain central to determining the full impact of the breaches.
