Polymarket Exploit Drains About $2.7M After Third-Party Provider Compromise
Author: Crypffalo Research · 03:54 30/10/2026
Polymarket moved to cancel-only mode after user accounts were drained via a compromised third-party provider; losses are estimated near $2.7 million and the platform pledges full refunds.
Prediction market Polymarket switched its exchange to cancel-only mode on Thursday, Oct 29, after users reported funds being withdrawn and positions sold from their accounts without their consent. The platform said one of its third-party providers had been compromised.
A suspected attacker wallet holds roughly $2.65 million in POL, according to Arkham data cited by The Block and Decrypt. DeFi Llama puts total losses at about $2.7 million. Polymarket says it has found and fixed the cause and that affected users will be made whole.
Key takeaways
- Losses: roughly $2.65–2.7 million per Arkham and DeFi Llama, and the figure may still change.
- Cause: Polymarket says a third-party provider was compromised but has not named it.
- Scope: the international platform, Polymarket.com, where positions were sold and assets moved out.
- Response: matching was halted and relayer actions paused, before systems were reported operational again.
- Refunds: Polymarket pledged to make affected users whole, with no method or timeline yet.
How the incident unfolded
Suspicious transactions began around 17:50 UTC, according to Decrypt's account. Users on X said their positions were dumped and balances drained within minutes.
- Around 18:55 UTC: Polymarket said the exchange was in cancel-only mode, with no new orders or trades processing and relayer actions paused.
- Shortly after: its status page flagged a major outage on the predictions trading API.
- Around 19:05 UTC: the platform reported all systems operational.
- Later: Polymarket said it had identified and fixed the issue and referred the case to law enforcement.
Some traders on X claimed six-figure losses, including one who said $800,000 was drained. These are individual claims that have not been independently verified.
Where the funds went, and a possible attack vector
The suspected wallet on Polygon received multiple swaps from USDC.e into POL via the cross-chain service Relay. The Block reported that some funds have since moved to other addresses.
Security firm Hudson Rock said a script loaded from web performance service DebugBear contained wallet-draining code. The script looked for a logged-in trading session, sold positions and transferred assets. Polymarket has not confirmed this, so it should be treated as a researcher's finding for now.
This is not Polymarket's first incident this year. In June, a third-party front-end breach took around $3 million and the platform promised full refunds. In May, a compromised private key drained about $700,000 from an internal top-up wallet.
What it means for crypto markets
The losses are modest compared with recent exchange hacks, and there is no sign of spillover into bitcoin or POL prices. The timing still matters, as prediction markets draw heavy capital and competition with rivals such as Kalshi heats up.
- Bull case: Polymarket refunds users quickly and publishes a clear post-mortem, keeping trust intact and making this a short-lived stumble.
- Risk case: actual losses prove larger or refunds drag, inviting tougher U.S. scrutiny of a sector already facing state-level legal challenges.
The wider lesson is software supply-chain risk: a single third-party script on a web front end can drain users even when smart contracts work as intended.
What to watch next
- Polymarket's official post-mortem naming the compromised provider and the number of affected accounts.
- Details and timing of the reimbursement plan.
- Movements from the attacker wallet, especially through bridges or centralized exchanges.
- Roughly $10–11 billion in bitcoin options expiring on Oct 30; see the economic calendar and real-time liquidations.
Frequently Asked Questions
Were Polymarket's smart contracts hacked?
There is no indication of that so far. Polymarket attributes the incident to a compromised third-party provider.
Will affected users get their money back?
Polymarket says anyone affected will be made whole. It has not yet shared how or when.
What should users do now?
Follow Polymarket's official channels and review account transaction history. Be wary of fake "refund claim" links that often appear after incidents.
*This content is for information only and is not financial advice.*
Tags: Polymarket, Hack, Security, Prediction Markets
Related articles
- Trump says US looking into Binance hack as CFTC chair pushes offshore oversight
- Binance targets Nov 1 withdrawal restart after finding more breach points in $6.3B hack
- Crypto stocks slide: Coinbase drops 12%, Strategy 11% as Binance hack weighs
- Binance sets aside $6.34 billion in corporate funds to cover hack losses
- Bitcoin Falls Below $77,000 as Binance Hack Triggers $1.5B in Liquidations
- Binance confirms $6.3 billion hack as analysts point to North Korea's Lazarus