Polymarket put its exchange in cancel-only mode and paused relayer actions after users reported drained accounts. The platform says one of its third-party providers was compromised and that it has referred the matter to law enforcement.
Polymarket halted new trading on its exchange and paused relayer actions on Oct. 29 while it investigated an incident. Later, the platform said one of its third-party providers was compromised.
Accounts drained on the international platform
Users reported seeing their assets withdrawn without approval on X, and CoinDesk confirmed that users with balances on the international platform saw their accounts drained. A trader posting as Car wrote at 1:45 p.m. ET that they had been drained of $800,000. The Defiant noted that the claimed loss and its cause remained unverified.
According to The Block, more than $2.6 million was lost within minutes. On Thursday, Arkham data showed that a wallet identified as belonging to a suspected attacker held about $2.65 million in POL after several recent USDC.e-to-POL swaps through Relay. The suspected attacker has since moved funds to different addresses.
Cancel-only mode and a paused relayer
Polymarket's status page logged a "major outage" at 2:05 p.m. ET for its prediction-market trading API. In a post on X, the platform said users can cancel orders, but no new orders or trades are processing.
Under Polymarket's documented rules, cancel-only mode also blocks orders to sell existing positions, according to The Defiant. The relayer normally submits wallet transactions without users paying network fees, so its pause stops those actions through that service.
Provider compromised, users to be made whole
Polymarket later said it had found the cause and fixed it. According to its status page: "One of our third party providers was compromised". The platform said it had referred the matter to law enforcement. The statement also said users would be made whole, but that trading had been halted.
The Defiant reported no time for service restoration and no established link to a June incident, in which a compromised third-party vendor injected a malicious script into Polymarket's website.
Sources: The Block, CoinDesk, The Defiant
Trading involves risk.
Risk Disclaimer
