Black October: $6.3 Billion Walked Out of Binance Through a Laptop

By Hoid Dismas, CEO of Ronin Inc

October 2026 will be remembered as the month the biggest names in tech learned the same lesson in the same week: the attacker doesn't break down your front door. He walks in through a door you gave to somebody else.

On October 29, Binance — the largest crypto exchange on Earth — lost roughly $6.3 billion in the biggest crypto theft ever recorded. The same day, prediction market Polymarket was drained through a tampered script from one of its vendors. The next morning, MUJI announced that up to 27 million customer records may have leaked from its app. Earlier in the month, Capcom disclosed a breach touching more than 11 million accounts, and Sony's internet provider arm reported up to 2.6 million member records gone.

Different companies. Different countries. Same shape. Here is what actually happened, sourced, and what it means.

What happened at Binance?

Binance lost around $6.3 billion across roughly ten blockchains on October 29, 2026 — the largest crypto theft on record — and the entry point was not a broken wallet key. It was a compromised laptop.

Blockchain analytics firm TRM Labs put the total at about $6.36 billion moved across 10 blockchains, and Binance itself confirmed a figure of "around $6.3B." (TRM Labs incident analysis, October 30, 2026; Binance Security Incident Update, October 30, 2026.) The drains began at about 20:04 UTC on October 29 and moved with machine speed: Bitcoin, Ethereum, Solana, Tron, XRP and more were swept in a main wave that lasted roughly twenty minutes, with a second wave hitting Avalanche and Polygon hours later. (Bitquery incident reconstruction, October 30, 2026.)

Binance's own preliminary finding is the part that matters: a DevOps engineer's compromised laptop allowed an attacker to reach an internal service container and submit unauthorized withdrawal transactions. Binance states there is no evidence any wallet private key leaked. (Binance Security Incident Update, October 30, 2026, via incident coverage in CCN and TradingView/99Bitcoins, October 30, 2026.) On Ethereum, the attacker used a feature from the 2025 Pectra upgrade (EIP-7702) to turn a Binance hot wallet into a "sweeper" contract that kept draining new deposits until Binance revoked the delegation early on October 30. (Sentora Market Incident Report, October 30, 2026.)

TRM Labs attributes the theft "with high confidence" to TraderTraitor, the North Korea-linked unit the FBI blamed for the $1.5 billion Bybit hack of February 2025. Chainalysis also attributes it to North Korea. Binance has not publicly named a suspect. (TRM Labs, October 30, 2026; CCN, October 30, 2026.)

The response was fast: Tether, Circle, Ripple and Aave froze roughly $2.7–3 billion of the stolen funds within hours, and Binance pledged to cover every user's loss in full from its SAFU fund and company funds, with withdrawals paused and expected to reopen by Sunday. (TradingView/99Bitcoins, October 30, 2026.) That doesn't change the lesson. The vault wasn't cracked. A person with a laptop was — and the laptop was the vault door.

What happened at Polymarket?

Polymarket's international platform was drained of an estimated $2.7 million from more than 700 traders on October 29 — not through Polymarket's own code, but through a compromised third-party script embedded in its website.

The vendor was DebugBear, a UK website-performance monitoring company whose JavaScript runs inside Polymarket's pages. Attackers tampered with that script so it abused traders' logged-in browser sessions — inspecting portfolios, selling positions and transferring the proceeds out through Polymarket's own transaction service. Blockchain firm Bitquery traced about $2.73 million across 737 accounts in roughly one hour; analytics firm Bubblemaps estimated about 700 users affected. Polymarket itself has not published a loss figure. (Casino.org, October 30, 2026; CCN, October 30, 2026; CNBC via Betting Intelligence/Polysights, October 30, 2026.)

Polymarket put its international platform into cancel-only mode, confirmed "one of our third-party providers was compromised," removed the script, resumed trading the same afternoon, referred the case to UK law enforcement, and committed to making every affected trader whole. The US platform was untouched. (Casino.org, October 30, 2026; Gaming America, October 30, 2026.) This was the third drain on Polymarket's international platform in 2026 — a vendor script compromise in June took about $3 million, and a leaked private key in May took about $700,000. (Casino.org, October 30, 2026.)

One script tag. Placed there on purpose, by the company, for a legitimate reason. That was the whole attack surface.

What happened at MUJI, Capcom, and Sony?

The same week produced three more disclosures, each an unauthorized-access story rather than a smashed core system:

• MUJI (Ryohin Keikaku) announced on October 30 that unauthorized external access to its official app may have exposed up to about 27.26 million records — email addresses, dates of birth, and gender, including former members with closed accounts. The company states no names, addresses, phone numbers or credit card details were involved, and that as of its announcement no misuse or dark-web leakage had been confirmed. It is, in the company's own framing, a potential leak. (Ryohin Keikaku announcement, October 30, 2026; Reuters via TradingView, October 30, 2026.)
• Capcom disclosed on October 22 that unauthorized access to its CAPCOM ID system, detected October 19, affected 11,774,247 accounts worldwide — email addresses and login metadata. No user passwords or credit card data were confirmed leaked, though 196 accounts had their passwords changed by the intruder before Capcom reset them. (Video Games Chronicle, October 22, 2026; Anime News Network, October 22, 2026.)
• Sony Network Communications (So-net), Sony's Japanese ISP arm, announced on October 27 that a third party accessed its member database on October 19, with up to about 2.6 million member records leaked — including the email passwords of 54,401 mail accounts and 16 bank-account records, and no credit card data. (Sony Network Communications notice, October 27, 2026; Help Net Security, October 28, 2026.)

And one more for the pattern file: Cathay Pacific disclosed that a compromise at its third-party provider Amadeus exposed about 53,000 booking records. Security researchers say there is currently no evidence these incidents share a single origin — which is precisely the point. This isn't one campaign. It's one condition, everywhere at once. (Dim Sum Daily, "Black October" roundup, October 30, 2026.)

What do all of these breaches have in common?

In every case where the entry point is known, the attacker came through a trusted connection — a vendor's script, an engineer's machine, a partner's system — not through the victim's core defenses.

Read the list again. Binance: a staff laptop with a path to production. Polymarket: a monitoring script a vendor was invited to run. Cathay Pacific: a booking provider. Nobody picked the lock on the main vault, because nobody had to. Modern systems are not fortresses with one gate. They are apartment buildings where every vendor, plugin, script and employee device holds a key — and the security model still pretends the front door is the problem.

The industry calls this "supply chain risk" and files it under compliance. That framing is too kind. A script you embed is not a supply chain. It is your code, running in your house, that you did not write and cannot see. A laptop that can reach production is not an endpoint. It is production, wearing a laptop costume.

What actually prevents this class of breach?

Governance at the door — every door — applied to everything that crosses, from anyone, every time. Prevention, not remediation.

Three rules fall out of Black October:

1. Nothing crosses unexamined. Every package, script, update and instruction that enters a system gets scanned and verified before it runs — including the ones from vendors you already trust, especially the ones from vendors you already trust. Polymarket's script was legitimate on Monday. Trust is not a scan.
2. Identity is verified, not assumed. The Binance withdrawals were "authorized" by the system that received them — submitted through a legitimate path from a compromised seat. A system that cannot tell the difference between its operator and someone sitting in the operator's chair has authentication theater, not authentication.
3. Concentration is a design choice, so make it yours. Your keys, your data and your signing authority should live in exactly one place that you control, sealed, with everything else treated as a visitor. The victims above all ran the opposite shape: authority smeared across vendors, scripts and laptops until nobody could say where the walls were.

This is the problem Scripture Armor was built for. It is not a scanner you run after something smells wrong, and it is not a cleanup crew — it is for people who haven't been hacked yet. Armor governs what crosses into your estate in the first place: sealed packages, verified identity, fail-closed on anything that doesn't check out, and an audit chain that shows every crossing. It is a private, commercial system, and access is application-gated — every deployment starts with a conversation, because a door is only as good as the person who decided where it goes.

I made the same argument before Black October gave it receipts: Breathing Room: Why the Patch Race Is Lost, and What Actually Ends It.

Black October cost the victims billions and exposed tens of millions of people's data. None of it required breaking anything. It only required being let in.

You don't need a password or a lock and key for a door that no one can find.

— Hoid Dismas

Sources

• Binance Security Incident Update, October 30, 2026 (via CCN, "Binance Hack: $6.3B Stolen in Crypto's Biggest Heist," and TradingView/99Bitcoins, "Binance Loses $6.3Bn in Largest Crypto Theft Ever," October 30, 2026)
• TRM Labs incident analysis, October 30, 2026; Bitquery incident reconstruction, October 30, 2026; Sentora Market Incident Report, October 30, 2026
• Casino.org, "Polymarket Hack Drains Estimated $2.7M From Hundreds of Traders," October 30, 2026; CCN, "Polymarket Hack: $2.7 Million… Third-Party Breach," October 30, 2026; Gaming America, October 30, 2026
• Ryohin Keikaku (MUJI), "Regarding the Potential Leak of Customer Information in Muji's Official 'MUJI App'," October 30, 2026; Reuters via TradingView, October 30, 2026
• Video Games Chronicle, "Capcom says a data breach affected more than 11 million Capcom ID accounts," October 22, 2026; Anime News Network, October 22, 2026
• Sony Network Communications (So-net) notice, October 27, 2026; Help Net Security, "Data breach at Sony-owned internet provider compromises 2.6 million customer records," October 28, 2026
• Dim Sum Daily, "Black October" roundup (incl. Cathay Pacific/Amadeus), October 30, 2026