Polymarket Halts Trading After Third‑Party Breach Drains User Funds
Polymarket pauses trading after a compromised third‑party provider let attackers siphon over $1.4 million from user accounts, prompting a cancel‑only mode and refunds.
CoinDesk and Decrypt both report that Polymarket, a popular crypto‑based prediction market, stopped new trades on Oct 29 2026 after a third‑party provider was breached and users saw large sums leave their accounts. The incident resurfaced a pattern of supply‑chain attacks on the platform and forced the exchange into a cancel‑only state while it investigates.
What happened
Polymarket announced that one of its external service providers was compromised, triggering an immediate pause on its trading API and switching the front‑end to cancel‑only mode – meaning traders can withdraw existing orders but cannot place new ones. The platform also halted its relayers, the off‑chain bots that take a user’s signed transaction and broadcast it to the blockchain.
User‑reported losses were dramatic. A trader known as CarOnPolymarket posted on X that his account was drained of $800,000, and a friend lost about $600,000. Decrypt cites Arkham data linking the stolen assets to a wallet (0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18) that now holds roughly $2.65 million in POL, Polygon’s native token, after swapping USDC.e via the Relay cross‑chain service.
Researchers at Hudson Rock traced the theft to a malicious script injected through a third‑party performance‑monitoring service, DebugBear. The script captured a logged‑in user’s session, issued sell orders for their positions, and directed the proceeds to the hard‑coded attacker wallet. Polymarket’s production code showed the script’s removal, but the exact entry point of the compromise remains unknown.
The company confirmed the breach on X, promised to make affected users whole, and said law enforcement had been notified. The statement mirrors a prior May incident where an internal top‑up wallet’s private key was exposed, costing $700,000, and a July breach that let hackers steal about $3 million from fewer than 15 accounts after a vendor injected malicious code. Those earlier events were also disclosed by Decrypt, not CoinDesk.
Why it works that way
Polymarket operates as a prediction market: users place bets on real‑world outcomes, and the platform records these positions on‑chain using smart contracts. Because the contracts sit on Ethereum‑compatible chains, the UI cannot directly move funds; instead it asks users to sign a transaction (e.g., “sell my position”) and forwards the signature to a relayer. The relayer then broadcasts the transaction, paying the gas fee and ensuring the trade reaches the blockchain.
When a third‑party service that supplies front‑end code or performance monitoring is compromised, the attacker can inject JavaScript that runs in the user’s browser. If the user is logged in, the script can access the signed transaction data the UI is about to generate. By automatically creating a sell order and setting the attacker’s address as the recipient, the script tricks the relayer into broadcasting a legitimate‑looking transfer. Because the user’s signature validates the transaction, the blockchain accepts it as if the user themselves had authorized the move.
The cancel‑only mode is a safety net built into many decentralized exchanges. When a platform detects abnormal activity, it can disable new order creation while still allowing existing orders to be withdrawn, limiting further exposure while preserving the ability for users to retrieve open positions. Pausing relayers stops any queued signed transactions from being sent, cutting off the last pathway for stolen funds.
What changes because of it
In the short term, Polymarket users must treat their accounts as compromised: lock passwords, revoke API keys, and move any remaining assets to a fresh wallet. The platform’s promise to “make users whole” will likely involve reimbursing the drained amounts, but the timeline and source of those funds (insurance, reserves, or external capital) remain unclear.
The breach highlights a broader supply‑chain risk for decentralized finance (DeFi). Even though the underlying smart contracts are immutable, the user experience hinges on off‑chain services—front‑end code, analytics, performance monitors, and relayers. A single vulnerable vendor can become a conduit for large‑scale theft, as seen here and in the July incident. Projects may respond by tightening code reviews of third‑party scripts, moving towards self‑hosted monitoring, or adopting zero‑knowledge proofs that let users prove intent without exposing private keys to external services.
For traders who simply hold prediction‑market tokens, the incident may be a wake‑up call to audit permissions and avoid re‑using the same wallet across multiple platforms. Institutional participants, who often rely on custodial solutions, might reassess the trade‑off between convenience (outsourced relayers) and security (in‑house transaction signing).
Looking ahead, two signals deserve attention: first, whether Polymarket can substantiate its “make whole” commitment without eroding its capital buffer; second, whether regulators will start scrutinizing third‑party service contracts in DeFi, potentially mandating disclosures or audits. Until then, the safest posture for users is to assume any front‑end component could be malicious and to keep the majority of assets in cold storage—wallets that never connect to the internet.
