A Very Bad 24 Hours for Crypto
· The Atlantic
This is an edition of Over/Under, a newsletter on the latest in prediction markets, gambling, and the evolution of everyday risk. Sign up here.
Last night, hackers stole approximately $6.3 billion from Binance, the world’s largest cryptocurrency exchange. The whole thing reportedly took about 20 minutes. It was the biggest theft in the history of the sector, and also probably the biggest financial heist of all time, topping the $1.5 billion ByBit hack of 2025 and Sadam Hussein’s $1 billion robbery of the Central Bank of Iraq in 2003. Binance says that about half of the stolen funds have been “frozen”—meaning that they’re effectively banned from being used in future transactions. North Korean hackers are thought to have been responsible.
Visit syntagm.co.za for more information.
In the hours before the attack, though, a smaller heist was roiling a different corner of digital finance: Yesterday afternoon, at least $2.6 million was reportedly drained from Polymarket accounts. This, too, was a crypto theft. Polymarket’s international platform, which until last month hosted the majority of the company’s trading volume, runs on blockchain technology. But the attacks had different origins, and there’s no evidence that the two are connected. Binance is saying that its hack may have involved a compromised laptop, as well as “additional points of breach”; thieves took money that was stored on the exchange. On Polymarket, hackers exploited a flaw in a third-party provider, allowing them to access users’ accounts. It was the firm’s second security lapse since June.
Both platforms say they plan to cover the losses in full. But in crypto, getting your money back isn’t a guarantee. Despite the technical differences and massive disparity in scale, yesterday’s hacks are a reminder that crypto-backed platforms of all kinds can still come with fundamental risks.
Unlike Kalshi, which has a single U.S. exchange for its domestic and international customers, Polymarket’s operations are split down the middle: Polymarket.com and Polymarket.us are two separate exchanges. When you make a bet on the U.S. site, your trade is settled in dollars. On the international site, everything is settled in crypto. The distinction matters. Both traditional financial firms and blockchain-backed systems face immense cybersecurity challenges—and the crypto industry has done a lot of growing up since 2022—but with crypto, customers typically have less recourse when things go wrong. Although deposits at U.S. banks are technically IOUs, they tend to be really good IOUs. If you ask for your money, you can be pretty confident that it will be there. If the bank fails, you’re guaranteed to get some of it back, thanks to the miracle of FDIC insurance.
Polymarket, like Binance, isn’t a bank, and its international platform isn’t overseen by the American regulatory system. (Both companies’ independent U.S. platforms, which are subject to onshore regulations, were entirely unaffected by these attacks.) Users may get their money back this time, as the firms have promised, but that’s not always the case—not all companies have the funds to repay their customers. They’re not necessarily obligated to, either.
Polymarket’s ties to crypto go back to its founding, in 2020, a moment when the industry was seen as a kind of Wild West. Early on, users could make bets on the site only if they were willing to ditch old-school money for digital tokens. Polymarket didn’t even have a domestic, non-crypto platform until late last year—and until very recently, it was seeing less volume than the international site. (The demographics for crypto and prediction markets still have some overlap too.)
This isn’t the end for Polymarket, and it’s certainly not the end for crypto, which has lately proved itself to be incredibly resilient. (Bitcoin is down a few thousand dollars since last night, but it hasn’t tanked nearly as much as you might expect after a disruption of this scale.) Still, the timing is unfortunate for the company. As I wrote on Wednesday, next week’s election coverage will put prediction markets in front of even more people. Users who have lost confidence in the company may end up switching over to Polymarket’s main competitor, Kalshi; users who aren’t familiar with prediction markets will have yet another reason to avoid them. Americans are already broadly skeptical of these firms’ push into politics. Polymarket’s link to crypto—and to the chaos of the past 24 hours—could further entrench that distrust.
Possible Futures
In every edition, I’ll share my thoughts on a few news stories I’m watching.
- On Wednesday, Utah’s attorney general filed 14 criminal charges against Kalshi and its co-founders, alleging that the company has been running a gambling platform against state rules. Both DraftKings and FanDuel have pulled some of their markets from the state, and Commodity Futures Trading Commission Chairman Michael Selig has pushed back, writing that Utah’s move sets a “dangerous precedent.” The agency is also suing the state (and many others), alleging that prediction markets can be regulated only on the federal level.