Binance lost control of roughly $6.3B in one evening, and its early findings point to a single engineer’s laptop rather than a smart-contract bug. The three weeks around it show the same pattern: a tampered hardware wallet supply chain, a breached cloud host, stale exchange wallets, and two prediction markets drained through third-party web scripts. If you hold funds on Binance or CoinDCX, bought a Ledger through CryptoBilis, stored keys on Railway, or traded on Polymarket or Predict.fun, the action steps below are for you.
| Metric | Number |
| Total plotted, 13 incidents | About $6.4B (sum of low-end figures) |
| Excluding Binance | About $120M |
| Binance share of total | About 98% |
| Keys, infrastructure and supply chain, excluding Binance | About 91% of dollars (8 of 13 incidents) |
Binance accounts for about 98% of the total
Binance’s own estimate of $6.3B dwarfs every other incident. The log scale keeps the smaller incidents readable, so compare bar lengths with care: each gridline is ten times the one before it.
Figure 1. Losses by incident, log scale. Color shows root cause (our classification).
Ledger and CoinDCX make up about 85% of the rest
Without Binance, the picture is a long tail. Ledger and CryptoBilis (an investigator’s estimate) and CoinDCX together account for about 85% of the remaining $120M, and no other incident passed $5M.
Figure 2. Losses excluding Binance, linear scale.
Infrastructure failures drive about 91% of non-Binance losses
Adding Polymarket (about $2.5M, traced) moved the keys, infrastructure, and supply-chain share from 90.5% to 90.7%. Code and logic flaws account for about 5%, and governance for about 4%.
Figure 3. Share of losses by root cause, excluding Binance.
Full Incident Table
| Date | Target | Loss | What Broke | Status |
| Oct 2 (catch-up) | Aave v3 Loop Safe Module | About 114 ETH | Safe module compromised across two multisig wallets | Flagged by SlowMist |
| Oct 9 to 13 | Ledger / CryptoBilis | About $86M (est. $72M to $93M) | Hardware implant in reseller-sold devices captured recovery phrases | Reseller halted sales; recent buyers told not to begin setup |
| Oct 10 | Papertrade (Hyperliquid) | About $1.28M | Spot price manipulation | Limited public detail |
| Oct 13 | Gamdom | $3M to $4.2M | Hot wallet reached after an outsider tied into one of its servers | Whitearmor claims 15.4M account records and demands $15M; Gamdom disputes the size |
| Oct 16 | Affluent (TON) | About $1.05M | Unbacked mint | Limited public detail |
| Oct 17 | Cysic bridge | About $727K extracted (10M CYS minted) | Database access plus a message-processing flaw | Bridge suspended pending external review |
| Oct 18 | Qubic | About $1.4M | Predictable wallet seeds drained 1,404 accounts | Restarted Oct 19; claims open until May 1, 2027 |
| Oct 20 to 22 | Railway (cloud host) | About $371K in linked thefts | Build-system breach exposed stored secrets | Rotate every stored key |
| Oct 21 | CoinDCX | About $16M | Old wallets from a 2025 breach drained after a sweeping service failed | Exchange absorbs the loss; Tether froze $2.2M USDT |
| Oct 21 to 23 | Swell | None confirmed (about 2,500 ETH flagged at risk) | Suspected hot or admin key compromise | swETH and rswETH paused; no ETH has left the contracts |
| Oct 21 | Fearless Wallet extension | 17,286 DOT (about $20K) reported | Four extension versions sent private keys to an attacker’s server | Move funds to new keys |
| Oct 23 | Initia | About $2.6M to $2.7M | Software flaw let the attacker create unbacked balances | Main chain and rollups paused as of Oct 24 |
| Oct 24 | X100 | About $4.85M | Flash loan captured governance; no timelock between approval and execution | Token down over 96% |
| Oct 25 and 28 | Yapeswap, Hifi Finance | $21.9K; not quantified | Malicious governance proposals | Limited public detail |
| Oct 27 | Predict.fun | About $400K USDT (29 wallets) | Compromised third-party API docs site injected a drainer script | Full reimbursement promised; docs site offline |
| Oct 29 | Polymarket | About $2.5M (unconfirmed) | Compromised vendor script (DebugBear) drained user wallets | Trading resumed after about an hour; traders to be reimbursed; UK police referral |
| Oct 29 | Binance | About $6.3B (est.) | Compromised DevOps laptop, unauthorized withdrawals | About $3B frozen; withdrawals paused |
Watchlist, next 14 days
- Binance: Withdrawal resumption, a full investigation, and an updated Proof of Reserves once remediation is done.
- Polymarket and DebugBear: A confirmed loss figure, reimbursement timing, and a root-cause account of how the script was altered.
- Ledger and CryptoBilis: A confirmed loss total and when reseller sales restart.
- Swell: No timeline has been given for resuming withdrawals.
- Initia: The fix and audit were estimated to take several days.
- Cysic: The attacker moved most of the ETH into Tornado Cash on Oct 23. The bridge stays offline until its review finishes.
- Predict.fun: Full post-mortem after the investigation concludes.
___________________________________________________________________________
In a busy world overflowing with information, Cryptopolitan’s tailored newsletters curate the most important updates, daily crypto news, Web3 jobs, events, and airdrops—delivered straight to your inbox.
Stay informed without the noise.
Sign up here: https://www.cryptopolitan.com/newsletters
