Polymarket Halts Trading After Suspected Supply-Chain Attack Drains User Accounts

Polymarket placed its exchange in cancel-only mode and paused all relayer actions on October 29 after users reported funds being withdrawn from their accounts without authorization, an incident the prediction market operator attributed to a compromised third-party provider.

The platform's status page confirmed a major outage of its trading API. Traders can cancel existing orders but cannot place new ones, and relayers — the infrastructure that submits users' signed transactions to the blockchain — have been halted entirely. The operator said it has referred the incident to law enforcement.

"We have identified & fixed an issue impacting our international platform, Polymarket.com," the company said on X. "One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement. Anyone who has been impacted will be made whole."

How large are the reported losses?

The most prominent victim, a trader posting as CarOnPolymarket, put his own loss at $800,000 and said a friend lost roughly $600,000.

"If you are a Polymarket user, lock down your account," he wrote on X. "I just got drained $800,000. Please be careful don't interact with the site."

On-chain analytics from Arkham identify a wallet flagged as the suspected attacker's — 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18 — holding approximately $2.65 million in POL, Polygon's native token. The wallet accumulated that balance through multiple recent swaps from USDC.e, the bridged version of the USDC stablecoin, into POL via Relay, a cross-chain swapping service. The first transactions began roughly an hour before the analysis, and the wallet showed no activity in the final five minutes of the observation window — a pause, not necessarily an endpoint.

What does the attack vector look like?

Researchers at Hudson Rock traced the incident to a script loaded from DebugBear, a web performance monitoring service, that was served on Polymarket's frontend. According to the firm, the script searches for a logged-in user's trading session and attempts to sell the user's positions and transfer the proceeds. The same wallet address identified by Arkham is hard-coded in the script as its fallback recipient.

Hudson Rock also noted that Polymarket's production site code records the script's removal, corroborating the supply-chain theory. The firm said it has not established how the compromise began or how many users were affected. Polymarket itself has not yet disclosed the root cause.

This is the third security incident at the platform this year. In May, a private key compromise drained roughly $700,000 from an internal top-up wallet. A month later, in June, a compromised third-party vendor allowed attackers to inject malicious code into the frontend and steal approximately $3 million from fewer than 15 accounts; Polymarket promised at the time to refund affected users in full.

What does this change for users and counterparties?

For active traders, the immediate consequence is operational: no new positions, no order placement, and no relayer-submitted transactions until the operator restores full functionality. For anyone who interacted with the site before the shutdown, the practical question is whether their session credentials were exposed to the injected script — revoking approvals and rotating credentials is the standard response to this class of attack.

For the broader prediction-market sector, the incident reinforces a structural point: frontend and vendor security now determines user-fund safety as much as the underlying smart contracts. Two of Polymarket's three 2026 incidents originated outside its own code.

Polymarket has committed to making affected users whole but has not specified a timeline, a claims process, or the total amount at stake — details that will determine how quickly trading confidence, and volume, return to the platform.