A Wave of Cyber Attacks on Crypto Exchanges and Service Providers

The past week has seen an extraordinary concentration of cyber attacks on the digital asset industry, ranging from the largest crypto theft on record at Binance to vendor-driven compromises affecting Polymarket, Coinbase and even blockchain intelligence firm Chainalysis. The incidents share recurring features: compromised employee devices and third-party software providers serving as entry points, rapid cross-chain laundering of stolen assets, and a critical window of minutes to hours in which funds can still be frozen.

Key Incidents

Binance Suffers a Record USD 6.3 Billion Hack

On October 29, 2026, an attacker drained Binance hot wallets across ten blockchains, with most of the funds leaving within approximately 20 minutes. Binance estimates the total impact at around USD 6.3 billion, roughly four times the USD 1.5 billion Bybit hack of February 2025. Binance’s initial investigation points to a compromised DevOps engineer’s laptop that allowed the attacker to access a service container and submit unauthorized withdrawal transactions; Binance later reported additional points of breach but no evidence of a private key leak. TRM Labs and Chainalysis attributed the attack to North Korea’s TraderTraitor group, citing the commingling of stolen funds with proceeds of last month’s Bitget hack.

Binance reported it suspended deposits and withdrawals, engaged law enforcement and blockchain intelligence partners, and pledged to cover all losses from its SAFU fund and company funds. Working with stablecoin issuers, including Circle and Tether, and other partners, approximately USD 3 billion was reported frozen on-chain.

Polymarket Users Drained Through a Compromised Third-Party Vendor

On the same day, users of Polymarket’s international platform saw their positions sold and funds withdrawn without authorization after malicious code was served through the platform’s website via a compromised third-party provider. Polymarket placed the exchange in cancel-only mode for about an hour, referred the matter to UK law enforcement and undertook to make affected users whole. Analytics firms estimate that roughly 700 users were affected and approximately USD 2.7 million was stolen. This is reportedly the second attack on Polymarket through an outside vendor since June 2026.

Chainalysis Discloses a Security Incident

On October 30, 2026, Chainalysis, whose blockchain intelligence tools are widely used by law enforcement, exchanges and financial institutions, disclosed that it had been the target of a cybersecurity incident. Chainalysis stated that it has found no evidence of unauthorized access to investigation content, authentication credentials or session tokens, that it has notified all of its customers, and that the incident is unrelated to the Binance theft. According to reports of its customer notice, the attacker used “offensive agentic techniques” and accessed customer user IDs, names, email addresses and role labels. Even security vendors are evidently targets, and leaked contact data can fuel targeted phishing.

Additional Incidents This Week

On October 28, 2026, Coinbase confirmed that a security incident at its analytics vendor, Amplitude, exposed a small subset of customer contact data, while stating that its own systems and customer funds were not impacted and that it is notifying affected customers and regulators. On October 26, 2026, attackers drained approximately 9,408 SOL (about USD 950,000) from some 48 wallets of nine users of the Telegram trading bot Bloom in 94 seconds, which Bloom attributed to a remote code execution vulnerability in a third-party module. In South Korea, Bithumb reported an intrusion into its internal mobile groupware system that exposed personal information, and exchange Pravang reported the theft of approximately USD 72,000 from its hot wallet.

Key Takeaways and How We Can Help

These incidents highlight that attackers increasingly target the crypto industry through people and suppliers, such as employee devices, analytics scripts and third-party modules, rather than the underlying blockchain protocols. They also show that a coordinated response in the first hours is decisive: a substantial portion of the Binance proceeds was frozen because exchanges, stablecoin issuers and analytics firms acted almost immediately.

While these incidents are still fresh our experience shows that a single incident can also trigger, at once, regulatory reporting duties, vendor obligations and litigation. Our team regularly advises clients in this industry, and can assist with: (i) immediate incident response, including coordination with blockchain analytics firms, exchanges, stablecoin issuers and law enforcement to trace and freeze stolen assets; (ii) urgent legal proceedings in Israel and abroad, including freezing and asset-preservation orders, disclosure orders against exchanges and service providers, and recovery claims; (iii) regulatory reporting and notifications to authorities and affected customers, including under privacy and data protection requirements; (iv) claims against, and negotiations with, compromised vendors and service providers, as well as cyber insurance claims; (v) customer communications, reimbursement programs and dispute management; and (vi) preventive review of vendor agreements, third-party risk management and incident response plans.

For further information or immediate assistance, please contact us.

The above content is a summary provided for informational purposes only and does not constitute legal advice. It should not be relied upon without obtaining further professional legal counsel.

Use up and down arrow keys to resize the meta box pane.

Move upMove downShow or hide panel

Featured image typePortraitLandscapeDateDownload file

No file selected Add File

Move upMove downShow or hide panel

Optimize your content for discovery.

Focus keyphrase

Use the main word or phrase you want your content found for across search, AI, and beyond. Learn more about best practices for keyphrases.(Opens in a new browser tab)

Search appearance

Determine how your post should look in the search results.Google preview

MobileGoogle preview: Switch to desktop preview. Currently showing mobile preview.

Desktop

Url preview:

Arnon,Tadmor-Leviarnontl.com

SEO title preview:

A Wave of Cyber Attacks on Crypto Exchanges and Service Providers – Arnon, Tadmor-Levy

Meta description preview:

Nov 1, 2026 － Israel’s Capital Market Authority issues final rules on custody and capital requirements for virtual currency service providers, effective January 2027.

SEO titleInsert variable

Title Page Separator Site title

Slug

Meta descriptionInsert variable

Israel’s Capital Market Authority issues final rules on custody and capital requirements for virtual currency service providers, effective January 2027.