Tech • AI • Robotics • Game
Degenerate Gamblers Keep Getting Hacked
7/10TL;DR
Polymarket, Binance and Ledger were hit by major security incidents, with the most consequential allegation being a $6 billion theft tied by the FBI to North Korean actors.
KEY POINTS
Polymarket site compromise
Polymarket, a crypto-based prediction market, was exposed through a front-end supply-chain attack rather than a direct breach of its core platform. Attackers reportedly altered DNS settings for DebugBear, a service used on the site, and replaced a normal CDN script with malicious JavaScript designed to drain user wallets. The incident temporarily knocked the referenced service offline and raised fresh concerns about financial platforms loading third-party code directly into live production systems.
User reimbursements drew criticism
Polymarket said it would make affected users whole, but reports indicate that customers seeking reimbursement of $10,000 or more were required to complete identity checks and sign an agreement containing a non-disparagement clause. That condition drew scrutiny because it appeared to restrict public criticism from users whose funds had been lost in the incident. The episode added reputational damage to a security failure that was already seen as preventable.
Binance linked to record crypto theft
A far larger case involved Binance, where the FBI attributed a theft of about $6 billion to North Korean hackers. If confirmed at that scale, it would rank as the largest known single-day crypto theft on record. The figure is also striking in geopolitical terms, amounting to a significant share of North Korea’s annual economic output.
Initial losses were partly frozen
During the response, roughly $3 billion in assets were reportedly frozen, limiting part of the immediate damage. But the attackers were still able to move substantial value beyond the reach of those controls. The case also highlighted a recurring contradiction in crypto markets: assets marketed as resistant to centralized control can still be frozen when issuers or platforms intervene.
Attackers exploited operational access
Binance said the breach stemmed from a sophisticated intrusion into internal engineering workflows. One key factor was a compromised DevOps laptop that held credentials or permissions tied to deployment and wallet-related systems. That disclosure triggered sharp questions about why any single workstation could help expose infrastructure connected to billions of dollars in assets.
Malicious ad and fake recruiter were central
The exchange later outlined a two-pronged social-engineering chain. In one case, an engineer allegedly installed a tampered version of Homebrew after clicking a malicious sponsored search result. In another, a software engineer was approached through a legitimate job platform by someone posing as a recruiter or project lead, then ran a test program on a work computer that was actually malware.
Internal tools and tokens helped widen the breach
After compromising one machine, the attackers reportedly used an internal AI tool as a springboard to access additional employees, including another engineer with container deployment permissions. They then deployed a malicious container and script that triggered the theft. The sequence suggested weak segmentation and insufficient safeguards around wallet operations, privileged credentials and high-value transaction execution.
Laundering tactics outmaneuvered freezes
The attackers also used fast-moving laundering tactics. One cited example involved depositing about $60 million in stolen USDT as collateral, borrowing roughly 19,762 ETH, moving the Ether, and leaving before broader freezing actions could fully contain the funds. That maneuver underscored how decentralized finance tools can be used to transform or distance stolen assets before blacklists take effect.
Ledger hardware-wallet tampering added another layer of risk
A separate case involved Ledger hardware wallets allegedly being intercepted in transit and modified with extra components capable of capturing highly sensitive wallet data. The implants reportedly remained dormant for extended periods before being used in thefts totaling about $86 million. The allegation widened the scope of concern from software compromise to supply-chain tampering in physical security devices themselves.
CONCLUSION
The incidents exposed repeated weak points across crypto infrastructure, from third-party scripts and phishing to privileged engineering access and hardware supply chains. Together they showed that even platforms built around self-custody and decentralization remain highly vulnerable to ordinary operational failures and sophisticated state-linked attacks.
Ask a question