Up to $5.8 billion under scrutiny at Binance, almost $16 million lost at CoinDCX, roughly $2.7 million reported at Polymarket, and millions more at Gamdom. October 2026 has been wild for crypto. Those figures describe different things, though: confirmed company losses, outside estimates and assets in suspected attacker wallets. Here’s where the money went and what affected users have been promised.
Where Are the Binance-Linked Funds?
You can follow the tracked addresses on Arkham’s binance-hacker-1029 page. It groups multiple addresses associated with the suspected incident. Reporting identified 55 addresses in the cluster, so this is a wider view than a single wallet.
For one reported Ethereum recipient, open the receiving address on Etherscan.
The early transfers were enormous. An examination of Ethereum transactions described approximately 167,464 ETH and 1.615 billion USDT moving from the wallet labeled Binance 14 on October 29. A later transaction sent 780 million USDC to the same recipient. These are individual movements within the incident, not extra losses to add to the largest circulating total.
The money also moved beyond the initial recipient. The Block reported nearly $900 million transferred onward across other wallets. So yes, some of the suspected proceeds were moving while investigators and issuers were responding.
Binance later reported $2.54 billion frozen, according to AP’s updated coverage. That means movement of affected assets had been blocked. It does not mean the same amount had already been returned to Binance or paid to customers.
The Arkham portfolio value also needs that distinction. It can include frozen assets and change with token prices. Its displayed balance is not a confirmed theft total or a measure of how much the wallet controller can spend. Reported snapshots should not be presented as current balances.
What Happened at the Other Platforms?
| Platform | Reported amount | What happened |
|---|---|---|
| Gamdom | Just over $3 million, according to its founder; about $4.2 million estimated by investigator vxdb. | A hot wallet breach took the platform offline on October 13. It moved remaining funds into cold storage and reopened on October 16. |
| CoinDCX | 15.99 million USDT, confirmed by the company. | Deposits accumulated in previously compromised addresses after a service meant to move them into secure wallets failed. |
| Polymarket | Approximately $2.6 million to $2.7 million in outside estimates. | A compromised third-party provider affected the international platform on October 29. Trading paused and later resumed. |
The figures above come from Gamdom’s reported statements, CoinDCX’s disclosure and reporting on Polymarket’s response. Polymarket had not published its own final loss total.
Polymarket’s technical evidence explains why simply using a familiar website could become risky. Hudson Rock researchers found malicious code in a script associated with DebugBear’s monitoring service. It was designed to reuse logged-in trading sessions and attempt sales or transfers to a designated recipient. Their analysis did not prove that every attempted action succeeded.
There was also evidence of onward movement. BleepingComputer’s blockchain examination found about 28.6 million POL, valued at roughly $2.57 million at the time, transferred from the suspected recipient to three other wallets.
That establishes crypto transfers, not a completed cash withdrawal into a bank account. The same distinction applies to the Binance-linked movements.
These incidents also do not establish that ordinary deposits and withdrawals were universally redirected. CoinDCX specifically described old, compromised deposit addresses. Polymarket’s malicious script targeted existing account access. A general replacement of Binance customers’ deposit or withdrawal addresses remained unconfirmed.
Who Covers the Losses?
CoinDCX says it credited customers and absorbed the loss itself. Its October 25 statement explained that crediting customer accounts and moving the underlying deposits were separate processes. The failure in the second process became the company’s loss.
Gamdom said customer funds were safe. That statement should be attributed to the company; it does not establish that the stolen assets were recovered.
Polymarket promised full reimbursement. As of October 30, the reporting reviewed did not establish a complete payment timetable, whether claims were required, or confirmation that every affected account had been repaid.
For Binance, FinanceFeeds reported a later statement promising to cover all losses and pausing deposits and withdrawals during security checks. The report did not provide the final damage, a funding breakdown or a reopening timetable.
Bybit provides a useful comparison. Its approximately $1.5 billion hack happened on February 21, 2025, so it is background to this story, not another October loss. The FBI attributed that theft to North Korea and said attackers converted some assets into Bitcoin and other cryptocurrencies, spreading them across thousands of addresses.
Bybit subsequently reported restoring full backing for in-scope customer assets within 72 hours. Yet its August 7, 2026 recovery update listed about $48.4 million recovered and another $30.5 million frozen.
Customer backing was restored long before the stolen assets were fully recovered. Bybit continued pursuing the money through exchanges, investigators and court orders.
That leaves two separate things to watch in October’s cases: assets actually recovered from the attackers, and repayments actually completed for customers. For someone whose balance disappeared, the missing detail is when the promised credit arrives and whether it can be withdrawn.