One engineer's laptop. That's where Binance's first look at the break-in points. By late Thursday, Oct. 29, the world's biggest crypto exchange put the loss at around $6.3 billion. The Journal calls it the biggest cyber heist in history. Deposits and withdrawals stopped. If you kept coins there, you could see them. You couldn't move them.
Sam Kessler and Vicky Ge Huang have the story in Friday's Journal. Founder Changpeng Zhao no longer runs Binance, but he's still its largest shareholder. He posted that user funds are safe. He added that two stablecoin companies, Tether and Circle, had frozen about $1.7 billion of the stolen money. A stablecoin is a crypto token built to hold steady at one dollar. Binance later put the frozen total at $3 billion, spread across several kinds of coins. A frozen token is dead money to the thief. It can't be spent or swapped for anything else. Two research firms, TRM Labs and Pangolin Intelligence, say the job looks like the work of North Korea's TraderTraitor hacking group. “This was absolutely North Korea,” said TRM's Nick Carlsen. The old record was $1.5 billion, taken from the exchange Bybit in 2025. This one is more than four times as big.
A smaller hole, same lesson
Polymarket had its own bad Thursday. Users found money missing from their accounts, and the site stopped trading. The weak spot was a vendor. DebugBear sells a tool that tracks how fast websites load, and its code ran on Polymarket's pages. A security flaw at DebugBear opened the door. A wallet tied to a suspected attacker appeared to pull more than $2.5 million from user accounts in more than 900 transfers, by the Journal's review. Polymarket says it fixed the vendor problem and that traders who lost money would be “made whole.” The site went to cancel-only mode. You could cancel an order, but you couldn't place a new one. Polymarket has taken the case to police in the U.K., where DebugBear is based, a person familiar with the matter told the Journal.
A word on our own habit. This desk quotes Polymarket odds on the Fed as a crowd signal. The Journal prints a Polymarket box in its Markets Digest, too. Those odds are prices people paid, never forecasts. Thursday showed the platform carries its own operating risk. We'll keep reading the odds that way.
Our read
This is Insurance and Consumer Protection, M11, and the subject is custody, meaning who actually holds your assets. A bank account has FDIC insurance, up to set limits. A brokerage account has SIPC protection, also up to limits, if the firm fails. Coins left on a crypto exchange have neither. You have the exchange's promise, and on Thursday that promise came with a locked door. Zhao may well be right that user funds are safe. The point is that nobody could test it while withdrawals were frozen. Two platforms, two different holes, one lesson. Where your money sits is a choice, and the easy default is often the riskier one.
Here's the check for this week. If you own any crypto, write down where each coin sits and who holds the keys, the secret codes that move it. It might be on an exchange, in a hardware wallet you control, or in a fund inside a brokerage account. Each one fails in its own way. Then check the size. Keep it small enough that losing all of it wouldn't move your retirement date. We're glad to map where everything you own is held, and what protects it, in a review. You check the umbrella while the sky is still gray, and on Thursday the clouds were plain to see.