EN
Español
Português (Brasil)
Türkçe
Tiếng Việt
Bahasa Indonesia
Polski
Čeština
Română
Slovenčina
Magyar29 Oct 2026
Polymarket put its exchange in cancel-only mode and paused relayer actions after users reported funds leaving their accounts. A wallet flagged as the suspected attacker's held about $2.65 million in POL, and Polymarket says a third-party provider was compromised and affected users will be made whole.
Polymarket, the largest crypto prediction market, halted new trading on Thursday after users reported that funds were being withdrawn from their accounts without permission. The platform placed its exchange in cancel-only mode and paused relayer actions while it investigated, according to Decrypt and The Block.
What happened
Polymarket’s status page showed the trading API in a major outage. In cancel-only mode traders can pull existing orders but cannot place new ones. Relayer actions, which submit users’ signed transactions to the blockchain, were also paused.
One trader, who posts on X as CarOnPolymarket, said his account was drained of $800,000 and that a friend lost around $600,000, and urged users not to interact with the site.
Arkham data showed that a wallet identified as belonging to the suspected attacker held about $2.65 million in POL, Polygon’s native token, after several swaps from USDC.e into POL through the cross-chain service Relay. The Block reported that the funds were later moved to different addresses.
Polymarket blames a third-party provider
Polymarket later said it had found and fixed the cause. “One of our third party providers was compromised, and we have referred this to relevant law enforcement,” the company said on X, adding that anyone impacted “will be made whole.”
Researchers at Hudson Rock said a script loaded from DebugBear, a web performance monitoring service, contained code that looked for a logged-in user’s trading session, tried to sell their positions and transfer the assets. The firm said the same attacker wallet was hard-coded in the script as a fallback recipient. Hudson Rock said it has not established how the compromise started or how many users were hit, Decrypt reported.
Not the first incident this year
Decrypt noted that in May a private key compromise drained roughly $700,000 from an internal Polymarket top-up wallet. A month later, a compromised third-party vendor allowed hackers to inject malicious code into the frontend and take about $3 million from fewer than 15 accounts, which Polymarket promised to refund in full.
What it means for traders
- If you use Polymarket, avoid interacting with the site until it confirms normal operations, and review any active sessions and connected wallets.
- Frontend and supply-chain attacks can hit users even when the underlying smart contracts are fine, so keep only what you actively trade on any single platform.
- Watch for Polymarket’s reimbursement details before assuming balances are restored.
Security and custody practices differ a lot between venues. See how exchanges compare in our crypto exchange comparison, read our BingX review (ranked number 1) and OKX review (number 2), and check how we test.
This is a developing story. This article is for information only and is not investment advice.
Follow TradeReviewed on X and our Telegram channel: you hear crypto and trading news here first.
Related reviews
Sources
- Decrypt: Polymarket Pauses Trading as Prediction Market Investigates Security Incident
- The Block: Polymarket pauses trading after $2.65 million exploit, says third-party provider was compromised
News is for information only and is not financial advice. More crypto news
You'll hear it here first
Get crypto news first on our Telegram channel.