Polymarket pauses trading after $2.65 million exploit tied to third-party provider
Security & Exploits ·
The prediction market platform moved to cancel-only mode after an attacker drained user funds through a compromised external service.
Polymarket halted trading and relayer actions on October 29 after detecting a security incident in which funds began leaving user accounts without authorization. The platform attributed the breach to a compromised third-party provider rather than a flaw in its own core infrastructure, and said the issue has since been fixed, according to The Block.
Blockchain analytics firm Arkham identified a wallet believed to belong to the attacker holding roughly $2.65 million in POL, built up through a series of USDC.e-to-POL swaps routed through Relay, per the same report. Users separately reported losses totaling about $2.6 million from their accounts, a figure corroborated by CryptoPotato.
With trading restricted to cancel-only mode, users could close existing positions but not open new ones or move funds through the affected channel while the platform investigated the scope of the compromise. Decrypt reported that the pause extended to relayer functions tied to the breached provider, underscoring that the exploit originated outside Polymarket's own trading engine.
Polymarket has said affected users will be compensated, though it has not detailed the compensation mechanism, timeline, or total amount set aside to cover losses. The suspected attacker wallet can be tracked on-chain, with activity visible through DeBank, though the identity behind the address remains unconfirmed.
What remains unclear is the exact identity of the compromised third-party provider, whether any funds can be recovered or frozen before further movement, and how long the cancel-only restrictions will stay in place before full trading resumes. The platform has not disclosed whether the $2.65 million figure represents the full extent of losses or whether additional accounts could still be affected as the investigation continues.