Polymarket Pauses Trading as Prediction Market Investigates Security Incident
-
Written by
Simonas Brazionis - Updated 2026-10-30 07:21:51
Polymarket Pauses Trading and entered a cancel-only mode after users reported unauthorized fund withdrawals. The prominent prediction market platform's status page indicated a major outage for its trading API, leading to a halt in relayer actions.
The company confirmed that a third-party provider had been compromised. Polymarket stated that the issue affecting its international platform, Polymarket.com, has been identified and resolved, and the matter has been referred to law enforcement. All affected users are assured full reimbursement.
Attacker Identified and Funds Traced
Arkham data identified a wallet, 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18, as belonging to the suspected attacker. This wallet reportedly holds approximately $2.65 million in POL, Polygon's native token. The funds were acquired through multiple recent swaps from USDC.e, a bridged version of the USDC stablecoin, into POL via Relay, a cross-chain swapping service.
The transactions commenced about an hour prior to the reports, with no further activity observed in the wallet for the subsequent five minutes. This rapid movement of funds highlights the swift execution of the compromise.
Details of the Attack and Past Incidents
Hudson Rock researchers indicated that a script loaded from DebugBear, a web performance monitoring service, contained code designed to detect a logged-in user's trading session. This malicious code would then attempt to sell their positions and transfer the assets. The same wallet address identified by Arkham was reportedly hard-coded into the script as a fallback recipient.
Hudson Rock noted that Polymarket's production site code recorded the script's removal, but the firm has not yet determined the origin of the compromise or the total number of affected users. This incident is not the first security challenge for Polymarket; in May, an internal top-up wallet lost approximately $700,000 due to a private key compromise.
The following month, a compromised third-party vendor allowed malicious code injection into the frontend, resulting in the theft of about $3 million from fewer than 15 accounts. Polymarket had also pledged full refunds to users in that prior incident.
