Polymarket Adds 48-Hour Wallet Lock After $2.73M Hack

Bitquery reported that attackers took $2.73 million from 737 Polymarket user accounts in about one hour, using 985 withdrawals that each carried a valid approval and were therefore treated by the smart contracts as real user actions.

The theft occurred between 17:10 and 18:10 UTC. Polymarket has since introduced a 48-hour lock on adding a new wallet address, while the broader compromise that enabled the theft remains unfixed.

On October 29, Polymarket paused trading on its international platform after attackers took over a script from DebugBear, a UK company that monitors website speed. Attackers swapped the script for code designed to drain wallets. Polymarket said it referred the case to law enforcement.

How the script drained accounts

Hudson Rock researchers found that the malicious script checked whether a visitor was logged in to Polymarket, read the visitor’s balances and open positions, and then used Polymarket’s own trading tools to sell those positions and transfer the proceeds to an attacker’s wallet. Hudson Rock also found that Polymarket’s site code recorded the script’s removal.

One account lost $358,369 in a single withdrawal. Another 276 accounts lost less than $100 each, and 33 other users had prediction-market shares taken. Polymarket said it would “make all its users whole,” with people who lost less than $10,000 refunded first.

The pattern is not confined to the October event. In June, a vendor-script attack drained about $3 million from at least 11 wallets, according to earlier Cryptopolitan reports. A December 2025 breach at an authentication provider also affected user accounts. Each case involved an outside provider, but nothing in the reported incidents links them to one attacker.

What does the 48-hour lock change for traders?

Polymarket’s control now requires two steps before a trader can add a wallet address:

• The trader confirms the request by email.
• The trader waits 48 hours.

If the trader did not initiate the request, the trader can cancel it directly from the email. Stevens said: “The goal is to make sure attackers cannot send money to any address the user does not control.”

The control blocks an attacker from sending funds to a newly added address without email confirmation and the two-day delay. It does not repair the root breach, which relied on a third-party script operating inside Polymarket’s site with access to live sessions.

Operationally, the delay contains a wallet-redirection route; it does not remove the compromised-script mechanism.

A Polygon hard fork is the next recovery decision

Binance and Polymarket have asked Polygon validators to approve a hard fork. A hard fork is a network software change that all validators must adopt. The proposal would move about 70.49 million frozen POL tokens, worth approximately $6.5 million, out of attacker wallets.

The proposal, posted on November 4 and presented at a Polygon governance call on November 5, still requires a vote and an implementation date. That leaves a direct choice for validators over whether to alter network rules to release the frozen assets.

Security controls shift to wallet limits

CertiK reportedly stated on Tuesday that, following the $6.3 billion Binance hack, exchanges should set hard dollar limits on the amount they keep in hot wallets rather than rely only on cold-storage ratios. That approach replaces a percentage-based allocation test with a maximum dollar exposure, limiting the amount an exchange can place within reach of a compromised operating wallet.

The next concrete checkpoint is a Polygon validator vote and an implementation date. Until then, the proposed transfer of 70.49 million frozen POL remains pending, while Polymarket’s 48-hour address delay limits a future payout route without remediating the script-compromise path behind the 737-account loss.