This is the second time Polymarket users have lost funds due to exploits Polymarket has blamed on third-party vendors. In June, customers lost almost $3 million after a malicious script was injected into the frontend. They reimbursed user losses then, and have said they will do the same in this incident as well.
Polymarket users' funds stolen, again
Polymarket users have lost a combined, estimated $2.65 million after a Polymarket exploit. The company acknowledged there had been "an incident" and put the site into "cancel-only" mode, meaning that all bets were disabled outside of cancelling them. They later, once again, claimed that the issue is due to the compromise of a "third-party provider", and re-enabled trading after about an hour.
Binance hacked for around as much as $5.5 billion, some frozen
Binance has confirmed that an attacker exploited the exchange, potentially stealing as much as $5.5 billion from multiple hot wallets.
Luckily for Binance, Tether and Circle quickly began freezing the exploiter's wallets. Tether froze at least $1.567 billion of the roughly $1.768 billion in stolen USDT, and Circle froze around $800 million of the $823 million in USDC. That leaves the attacker with somewhere around $3 billion.
Binance founder Changpeng Zhao, who is not legally allowed to run the exchange yet seems to remain very closely aware of its inner workings, posted early estimates of the freezes and wrote, "I don’t manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered." He later added, "Loss might be a bit higher than [$1 billion], but will cover."
At least $86 million stolen via tampered Ledger hardware wallets resold by CryptoBilis
The users of more than 300 Ledger cryptocurrency wallets have suffered an estimated $86 million to $93 million in losses after thieves drained assets across blockchains including bitcoin, Ethereum, and Tron. Ledger is a popular manufacturer of hardware wallets — a type of physical, offline device used to store cryptocurrency keys in an attempt to be more secure than storing keys on Internet-connected devices.
Ledger has claimed that the targeted wallets appear to have been sold via CryptoBilis, a Southeast Asian reseller that operates in Indonesia, Malaysia, and the Philippines. Ledger said that at least one affected device "contained an unauthorized hardware implant". Several third party researchers disassembled affected hardware devices, finding that a chip and antenna had been added to capture crypto wallet seed phrases and transmit the data to the attacker using a cellular connection.
Near Intents exploited for $3.8 million, recovers all assets
Near Intents, a cross-chain swap service, halted operations after an attacker drained around $3.8 million by exploiting a bug in its Omni layer.
The next day, Near Intents posted addresses for returning the funds and threatened the attacker: "We have identified you, sir." The attacker returned everything the next day, in a transaction that included an on-chain message saying "We've returned all the funds, we were in the wrong". Near Intents confirmed the funds were returned, and said they were stopping their investigation.
Magic Eden users lose NFTs and $1.8 million in wETH to legacy approvals exploit
Exploiters took advantage of a legacy approvals bug in an old payment processor called Limit Break, which the platform had stopped using in late 2024. The bug affected listings on Magic Eden's EVM marketplace, which the company had shut down earlier this year. The attackers were able to steal numerous NFTs, including 10 Meebits, 50 Otherdeeds, 10 World of Women, and 235 Desperate Apewives. Attackers also subsequently stole 660 wETH (~$1.78 million).
A whitehat rescue spearheaded by blockchain researcher 0xQuit took control of 23,155 NFTs he estimated to be worth "north of $5.7M USD", which he said would be returned to their owners after they revoked the permissions that made the assets vulnerable to theft.
Meter token prices crash after unauthorized mint
An exploiter was able to mint unbacked wrapped MTR and MTRG tokens, notionally priced at more than $2.3 million. They sold some of the tokens on a decentralized exchange, crashing the MTRG price by more than 88%. The price of the project's MTR token — which is supposed to maintain a stable price based on the cost to produce 10 kWh of electricity — also plummeted by approximately the same percentage. Meter has attributed the exploit to a "block validation flaw".
Meter paused the blockchain and bridge, and has urged people not to trade the token. They have warned that "Transactions after block 100731417 may not be honored", suggesting they are considering a blockchain rollback.
Meter suffered another bridge attack in February 2022, which amounted to $4.3 million.
Payy Network bridge fully drained of $1.8 million
The Payy Network, a stablecoin infrastructure company, disclosed that a bridge contract had been fully drained of funds, netting attackers $1.8 million. They later stated that the theft was "NOT a compromised key, social engineering or exploit of our off-chain infrastructure," but has not disclosed what it was. They also announced that the stolen funds were "users' non-custodial deposits to Payy Network / Payy Wallet", which is somewhat of an oxymoron.
Payy Network has halted all activity following the attack.
Duelbits crypto casino goes offline after $7 million theft
The Duelbits crypto gambling site lost around $7 million to an apparent hot wallet compromise. The site went offline shortly after the attack, and the company has said the site will stay offline "until we have clarity". The Curaçao-based platform offers casino games and sportsbetting.
Bitget crypto exchange hacked for $388 million, pauses withdrawals
Attackers stole $387.5 million in crypto assets from Bitget, a cryptocurrency exchange originally founded in Singapore and headquartered out of the Seychelles. Centralized stablecoin issuers Circle and Tether (issuers of USDC and USDT) froze $318,000 in stolen assets, but the vast majority were swapped to decentralized cryptocurrencies and have not been frozen.
Bitget CEO Gracy Chen has said the company believes that a North Korean cybercrime group may be behind the theft. Bitget halted withdrawals shortly after the theft was noticed, citing the need to prevent attackers from stealing more assets. Bitget has said they have sufficient assets to cover the stolen funds.
Projects on the defunct Neutron chain lose $1.8 million to governance attack, Cosmos Hub halts chain
Neutron, a blockchain in the Cosmos ecosystem that entered maintenance mode in June, suffered a governance attack when someone spent $20,200 to acquire enough NTRN governance tokens to pass a vote allowing them to take control of the Neutron-based Astroport and Drop applications, whose contracts contained a combined $9.5 million in assets.
Neutron was paused shortly after the attack, and validators subsequently paused the entire Cosmos Hub network. Together, the pauses prevented the attacker from cashing out the entire amount, though they successfully made off with $1.8 million that they were able to bridge to Ethereum prior to the pause. Cosmos Hub remained paused for approximately 24 hours. During the pause, validators coordinated to move approximately 1.73 million ATOM from the attacker's wallet to a multi-signature wallet controlled by a group of companies operating network validators.