In brief
- Polymarket put its exchange in cancel-only mode and paused relayer actions as users report funds withdrawn without permission.
- A wallet flagged as the suspected attackers holds about $2.65 million in POL, per Arkham data, after multiple USDC.e-to-POL swaps through Relay.
- Hudson Rock says a DebugBear-hosted script containing wallet-draining code hard-codes that same address as its fallback recipient.
Polymarket users are reporting that the prediction markets frontend may be compromised, with assets being withdrawn from accounts without permission.
The platform‘s status page shows its trading API in a major outage and the exchange in cancel-only mode, meaning traders can pull existing orders but not place new ones. Relayer actions, which submit users’ signed transactions to the blockchain, are also paused.
“If you are a Polymarket user, lock down your account,” a trader who goes by CarOnPolymarket said on X. “I just got drained $800,000.”
“Other accounts are also affected,” he said, adding that a friend lost around $600,000. “Please be careful dont interact with the site.”
If you are a Polymarket user, lock down your account. I just got drained $800,000
Other accounts are also affected. Friend got drained $600k
Please be careful dont interact with the site
Polymarket later confirmed that one its third-party providers was compromised. “We have referred this to relevant law enforcement,” the company said on X. “Anyone who has been impacted will be made whole.”
Arkham data shows that a wallet identified as the suspected attacker‘s, 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18, holds about $2.65 million in POL, Polygon’s native token. It received multiple recent swaps from USDC.e, a bridged version of the USDC stablecoin, into POL through Relay, a cross-chain swapping service.
We've identified & fixed an issue impacting our international platform, Polymarket.com. One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement.
Anyone who has been impacted will be made whole.
Out of an abundance of caution, we…
The first transactions began about an hour ago, and the wallet has shown no activity in the last five minutes.
Researchers at Hudson Rock said a script loaded from DebugBear, a web performance monitoring service, contains code that looks for a logged-in users trading session and attempts to sell their positions and transfer the assets.
BitcoinBTC · USD
$80,816−0.83%
24H7D1M1YYTD
Oct 22Oct 24Oct 26Oct 28Oct 29
$82.0k$81.2k$80.4k$79.6k
24h HighHigh$81,840
24h LowLow$79,636
VolVol$1.2B
→
Buy Bitcoin with USDT
Powered by Jupiter
$50$100$500
Buy
Price data by CoinGeckoCoinGeckoMore Bitcoin news and projections →
The firm said the same wallet address is hard-coded in the script as its fallback recipient, and that Polymarket‘s production site code records the script’s removal. Hudson Rock said it has not established how the compromise started or how many users were affected.
Polymarket has not yet said what caused the incident. In May, a private key compromise drained roughly $700,000 from an internal top-up wallet. A month later, a compromised third-party vendor let hackers inject malicious code into the frontend and steal about $3 million from fewer than 15 accounts, and Polymarket promised to refund users in full.
Editor's note: This story was updated after publication to include additional details from Polymarket.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
Email addressJoin free
Join 72,000+ readers
Create an account to save your articles.
Add on Google
Add Decrypt as your preferred source to see more of our stories on Google.