On October 29, two attacks on two very different platforms ended the same way. At Polymarket, a hijacked website script emptied 737 accounts of about $2.73 million in roughly an hour. Hours later, about $6.36 billion left Binance’s hot wallets across 10 blockchains, most of it in around 20 minutes, in what is being called the largest theft in crypto’s history. While the dollar figures differ by several orders of magnitude, both attacks exposed a similar underlying weakness in that attackers gained access to the authority the systems already trusted, allowing them to act without creating a new account or defeating the initial identity checks. In both cases, the attacker borrowed the authority of someone the system already trusted and let the system do the rest.
How It Went Down
Binance’s account of its own breach reads like a recruiting story. According to the exchange’s disclosure, a software engineer was approached on a job-hunting platform, sat through a series of fake interviews, including one with a supposed chief executive, and downloaded an assignment that opened his machine to the attackers. From there, with the help of an internal AI tool, they reached a DevOps engineer on the wallet team whose computer held a container deployment token.
Binance’s initial findings report that the attacker used that access to a service container to submit unauthorized withdrawal requests, and the exchange has found no evidence that wallet private keys were leaked. The requests came from inside Binance’s own infrastructure, carrying whatever authority that container held, and to the systems downstream they looked like work.
Polymarket’s case is smaller and, in some ways, more instructive. Attackers hijacked a third-party performance-monitoring script running on the site. Instead of measuring page speed, the code checked each visitor’s browser for the markers of an authenticated session. If it found them, it located the site’s own order client and used it to sell positions and request withdrawals. In a sample of 30 drains, Bitquery found each withdrawal approval was used within three to seven seconds of being signed, and every drain went out through Polymarket’s own relayer as a normal transaction. No smart contract was touched, and no password changed hands. The platform later reset every active session, which tells you where the authority had been living.
The industry has poured investment into securing the front door for over a decade. Onboarding, identity verification, sanctions screening and device fingerprinting have all improved enormously, and they answer one question well: whether the person opening this session is who they claim to be. In both October attacks, the systems answered that question correctly, and the money left anyway.
Verification is a Moment, Trust is a Duration
In most financial systems, an identity check establishes who opened the session, and often that is the last time anyone looks. From that point on, a token, cookie or a signed approval carries the full weight of the user’s authority, and anything that can get hold of it inherits its authority wholesale.
Contemporary attackers have done the math. Forging an identity means defeating verification that gets harder every year, but hijacking a session means waiting for a legitimate user to do the hard part, then stepping into the room behind them. A compromised endpoint, a poisoned browser script, a malicious extension or an intercepted mobile app all deliver the same prize — a session that looks to every downstream system exactly like the customer.
This is why the Polymarket figure concerns me more than its size suggests. The sum is modest; draining 737 live sessions in one hour, through a script the platform itself chose to load, is a proof of concept for any consumer-facing financial product with a web front end.
The Interview Was the Exploit
The hiring angle makes the same point from the other side. My colleagues have written about fake applicants using synthetic identities to get inside companies, and the FBI warned again last month about North Korean operatives posing as remote IT workers. Binance’s intrusion ran that script in reverse. The attacker sat on the employer’s side of the table, and the interview itself delivered the malware. In both versions, the attacker sought access after the identity check, so the check itself never failed.
In coached fraud, the applicant is real, the identity is real and the documents are real. A scammer sits beside the borrower, on a call or in a chat window, directing every step of the application. Verification passes because there is nothing to fail — the session is legitimate — only the intent behind it is fraudulent. The lenders I have seen catch coached fraud do so by watching what happens inside the session rather than at its threshold: hesitation on fields a genuine applicant would answer from memory, pasted values where typing is expected, a pace that matches dictation rather than recall.
The Signal Lives in the Behavior
The same logic applies to a trading account or an exchange’s internal signing service. A session that suddenly liquidates every position, approves a withdrawal seconds after signing and routes funds to an address the account has never used is behaving unlike the person who logged in, however valid its token may be.
Continuous monitoring of the authenticated session is not a new idea. Most institutions simply treat it as an appendix to the login rather than as the primary control, and that ordering needs to flip. It starts with a baseline. Every account and every privileged employee has a rhythm of session length, navigation paths, transaction sizes and approval cadence. Changes in those patterns can provide early signals that something is wrong, often before a transfer settles.
It continues with environmental integrity, meaning the institution checks the device, the browser and the scripts it has loaded throughout the session, not only at sign-in. A login check never revisits what a trusted script contains. The last element is authority to act. Detection that produces an alert for a team to review tomorrow is useless against an attack that completes in 20 minutes. The control has to be able to step down a session, hold a transaction or require a second signature on its own, and someone has to own that decision in advance.
Banks Should Not Watch From the Sidelines
The crypto industry absorbed the immediate damage with Binance saying it has replenished about 95% of the affected assets from its own resources and insurance funds, and reports that roughly $3 billion was frozen. In comparison, customers withdrew a net $4.72 billion once access reopened. The freezes recovered part of the loss, but they came after the money had already gone.
Banks and payment firms face the same underlying challenge. Faster payments, open banking tokens, long-lived API sessions and remote administration all extend the life of an authenticated moment, and each extension lets someone who was never verified act as someone who was. The previous record for a crypto theft, the $1.5 billion taken from Bybit in February 2025, began with a compromised developer machine at Safe, the multisig interface Bybit’s signers were using, the same pattern of borrowed authority. Bybit’s loss warned the sector, and the warning was not enough.
A board should ask its risk and security leaders what, specifically, is still being watched about a user or employee after verification, and what it can stop. If the honest answer is a rules engine that fires only once the transfer is already in flight, the institution is defending a perimeter that attackers abandoned some time ago.
