✓ Verified by 4+ outlets
Polymarket halts trading after a hacked third-party provider drains user accounts, and promises to make victims whole
Summary
Polymarket put its exchange in cancel-only mode and paused relayer actions on Oct. 29 after users reported funds being withdrawn from their accounts without permission, Decrypt, CoinDesk and The Block reported.
The prediction market later said one of its third-party providers had been compromised, that it had fixed the issue affecting its international platform, that it had referred the matter to law enforcement and that anyone affected would be made whole, according to all three outlets.
Arkham data shows a wallet identified as the suspected attacker's holding about $2.65 million in POL after a series of USDC.e-to-POL swaps through Relay, Decrypt and The Block reported; The Block said more than $2.5 million was lost within minutes and that funds have since moved to other addresses.
Polymarket has not said what caused the incident, Decrypt noted, and the number of affected users has not been disclosed.
Updates
- Update, : Update (Oct. 29): Cointelegraph reported that Polymarket's status page said all systems were operational as of 7:05 p.m. UTC. Cointelegraph put the June vendor-related loss at more than $2.9 million, while Decrypt had described it as about $3 million.
Key facts
- In cancel-only mode traders can pull existing orders but cannot place new ones or trade, and relayer actions, which submit users' signed transactions to the blockchain, were paused, Decrypt and The Block reported.
- CoinDesk said it confirmed that users with balances on Polymarket's international platform saw their accounts drained.
- A trader who goes by CarOnPolymarket said on X they were drained of $800,000 and that a friend lost about $600,000, Decrypt reported; those figures are the trader's own claims.
- Researchers at Hudson Rock said a script loaded from web performance service DebugBear contains code that tries to sell a logged-in user's positions and transfer the assets, and hard-codes the suspected attacker's wallet as a fallback recipient, according to Decrypt.
- Decrypt noted earlier incidents this year: a private-key compromise that drained about $700,000 from an internal top-up wallet in May, and a compromised vendor that let hackers steal about $3 million from fewer than 15 accounts a month later.
- The Block described the story as developing.