Web3 is Going Just Great

This is the second time Polymarket users have lost funds due to exploits Polymarket has blamed on third-party vendors. In June, customers lost almost $3 million after a malicious script was injected into the frontend. They reimbursed user losses then, and have said they will do the same in this incident as well.

Luckily for Binance, Tether and Circle quickly began freezing some of the exploiter's wallets. Tether froze at least $1.567 billion of the roughly $1.768 billion in stolen USDT, and Circle froze around $800 million of the $823 million in USDC. Binance estimated that $3 billion in total was frozen, though some other networks that have frozen assets are preventing the attacker from cashing out, but may not be able to easily restore them to Binance.

Binance founder Changpeng Zhao, who is not legally allowed to run the exchange yet seems to remain very closely aware of its inner workings, posted early estimates of the freezes and wrote, "I don’t manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered." He later added, "Loss might be a bit higher than [$1 billion], but will cover." Binance later disclosed that they believed the exploit occurred after a devops employee's laptop was compromised.

Blockchain security firm TRM Labs subsequently attributed the attack to TraderTraitor, a North Korean state-sponsored cybercrime group also known as the Lazarus Group. They have been behind many of the largest cryptocurrency thefts, including the now second-largest hack of all time: the 2025 theft of $1.5 billion from the Bybit exchange.

The announcement comes days after the Blur team said it would also shut down Blast, its Ethereum layer-2 blockchain, because it cost more to run than it earned.

Ledger has claimed that the targeted wallets appear to have been sold via CryptoBilis, a Southeast Asian reseller that operates in Indonesia, Malaysia, and the Philippines. Ledger said that at least one affected device "contained an unauthorized hardware implant". Several third party researchers disassembled affected hardware devices, finding that a chip and antenna had been added to capture crypto wallet seed phrases and transmit the data to the attacker using a cellular connection.

Users have until December 15 to move their assets, after which anything left on the chain will become inaccessible. DefiLllama estimates there were around $76 million in assets on the chain when the shutdown was announced, leading some users to complain that the wind-down period is too short.

The shutdown comes a few months after Igloo shut down its Pudgy Party mobile game, which had dropped to around 200–300 active users shortly after its launch, and also lost the company millions of dollars.

After bungling the mint, selling fewer than 2,000 of the planned 7,500 NFTs after buyers balked at the 0.911 ETH (then $1,490) pricetag, the price went nearly exclusively downhill. Now, with the NFTs floundering with floor prices down 96% from launch, Porsche has announced it is ending its "shared adventure".

The next day, Near Intents posted addresses for returning the funds and threatened the attacker: "We have identified you, sir." The attacker returned everything the next day, in a transaction that included an on-chain message saying "We've returned all the funds, we were in the wrong". Near Intents confirmed the funds were returned, and said they were stopping their investigation.

In June, a similarly low-participation vote handed "stewardship" of the project to a different group which promised to "revitalize" Abracadabra. Days later, treasury wallets sold around $500,000 worth of MIM. In July, the project tweeted that a roadmap to restore the peg was "coming this week," then never posted again. A week after that tweet, Abracadabra-controlled wallets moved about $8.3 million in treasury assets with no explanation, some of it to a Binance deposit address, in what one commentator called "treasury looting". The wind-down proposal doesn't mention the $8.3 million or count it toward what MIM holders could redeem.

A whitehat rescue spearheaded by blockchain researcher 0xQuit took control of 23,155 NFTs he estimated to be worth "north of $5.7M USD", which he said would be returned to their owners after they revoked the permissions that made the assets vulnerable to theft.

Meter paused the blockchain and bridge, and has urged people not to trade the token. They have warned that "Transactions after block 100731417 may not be honored", suggesting they are considering a blockchain rollback.

Meter suffered another bridge attack in February 2022, which amounted to $4.3 million.

Payy Network has halted all activity following the attack.

Bitget CEO Gracy Chen has said the company believes that a North Korean cybercrime group may be behind the theft. Bitget halted withdrawals shortly after the theft was noticed, citing the need to prevent attackers from stealing more assets. Bitget has said they have sufficient assets to cover the stolen funds.

Neutron was paused shortly after the attack, and validators subsequently paused the entire Cosmos Hub network. Together, the pauses prevented the attacker from cashing out the entire amount, though they successfully made off with $1.8 million that they were able to bridge to Ethereum prior to the pause. Cosmos Hub remained paused for approximately 24 hours. During the pause, validators coordinated to move approximately 1.73 million ATOM from the attacker's wallet to a multi-signature wallet controlled by a group of companies operating network validators.

Most of the profits came from stolen FET tokens, which are linked to Fetch.ai. The attacker was also able to perform unauthorized mints of various tokens, crashing their prices but earning the attacker little in the way of profits. Security researchers noticed that attackers stole assets from sixteen wallets spanning the three companies, suggesting they had significant access to all three companies' systems. Almost $290,000 was taken from a contract used for company payroll.

The unauthorized transaction included a message reading "we are whitehats. contact us on chain", suggesting the possibility that the withdrawal was in fact well-intentioned security researchers aiming to "rescue" funds after discovering they were vulnerable and then return them to a secure wallet. After some back and forth, the attacker returned 3,400 BTC (~$272 million) keeping 600 BTC (~$48 million), likely as a "bounty".

Cronos was launched by the exchange Crypto.com in 2021, and although the two entities are technically separate, they remain very closely linked. Because the Cronos chain is maintained by a relatively small number of validators, many controlled by Crypto.com, it was relatively easy to halt the chain — though the move was criticized by some who felt that it only illustrated Cronos' lack of decentralization and immutability. Some criticized the decision to halt the chain for nearly 24 hours over an exploit of a third-party protocol.

The losses are somewhat unusual because the neobanks describe themselves as self-custodial, which normally means that customers have total control over their crypto assets rather than storing them on a third-party platform. Normally, self-custody is more resilient to exploits like this, given that assets remain in user wallets. However, because these neobanks require customers to load funds they want to be able to spend into a third-party contract, they were vulnerable to the theft.

This theft is the fourth Moonwell exploit in less than a year, following a $3.7 million oracle manipulation attack in November 2025, another oracle attack in February 2026 amounting to $1.78 million, and a $1 million governance attack in March.

The attacker withdrew around 2,843 ETH (~$6.9 millon) and $1.68 million in the USDC stablecoin, amounting to about 68% of assets on the platform.

Term Finance previously lost $1.65 million to an oracle misconfiguration error in April 2025, but recovered $1 million of the funds.

KiiChain was exploited for around 148 million KII, which the attacker was able to cash out for around $1.6 million. TAC, a Telegram-focused blockchain, was exploited for about 3 billion TAC (~$7.5 million). Nesa Chain was exploited, and though an attacker was able to steal tokens nominally worth $50 million, lack of liquidity limited their profits to around $60,000. A blockchain called MANTRA also halted due to an exploit, but the network said that no user funds were impacted.