Polymarket halts trading after suspected wallet drain
Security & Exploits ·
Platform moves to cancel-only mode as a wallet linked to the incident holds roughly $2.65 million in POL tokens.
Polymarket halted trading and put the exchange into cancel-only mode, pausing relayer actions while it investigates an incident. The platform's official status page listed a major outage as of 18:05 UTC, coinciding with reports from several users that their accounts had been drained.
A wallet suspected of being behind the drain currently holds about $2.65 million in POL, the token associated with Polygon, according to on-chain data. The cancel-only setting restricts users to closing out existing orders rather than placing new ones, a common first response for exchanges containing a suspected exploit while they assess the scope of exposure.
The episode has since been folded into a broader disclosure from Polymarket, which said the underlying cause was a breach involving a third-party service provider rather than its core infrastructure. The platform stated the issue has been fixed and that affected users will be compensated. Separately, Polymarket said it resolved a related issue affecting international users, also with a compensation commitment, suggesting the disruption extended beyond a single user segment.
Multiple accounts converged on the same sequence of events: an initial halt and restriction to order cancellation, followed by investigation, and then a resolution tied to a third-party provider rather than an attack on Polymarket's own systems. The coverage does not specify which third-party provider was compromised, how the drained funds were initially accessed, or whether the $2.65 million figure represents the full extent of funds moved to the flagged wallet.
Not yet disclosed is the total number of affected users, the exact compensation mechanism or timeline, and whether the wallet holding the POL tokens has taken further action since being identified. It also remains unclear whether trading has fully resumed beyond cancel-only mode, or what controls Polymarket plans to implement with its third-party providers to prevent a repeat incident.