Polymarket Suspends Trading Amid Security Incident; Users Report Unauthorized Fund Transfers

Polymarket has switched its exchange to "order cancellation only" mode and paused relayer operations; this follows reports from users that funds were transferred without authorization.

According to Arkham data, a wallet flagged as a suspected attacker holds approximately $2.65 million in POL; previously, this address executed multiple swaps from USDC.e to POL via Relay.

Hudson Rock stated that a script hosted by DebugBear contained code suspected of emptying wallets and hard-coded the same address as a backup receiving address.

Polymarket users reported that the frontend of this prediction market platform may have been compromised, resulting in unauthorized transfers of account assets.

The platform’s status page indicates a major outage in its trading API, and the exchange has entered “cancel-only” mode, meaning traders can cancel existing orders but cannot submit new ones. Relayer operations have also been suspended. Relayers are responsible for submitting user-signed transactions to the blockchain.

If you are a Polymarket user, please lock your account immediately, said a trader using the name CarOnPolymarket on X: “I just had $800,000 transferred out of my account.”

Other accounts were also affected,” he said, adding that a friend lost approximately $600,000. “Please be cautious and avoid interacting with this website.”

Polymarket later confirmed that one of its third-party service providers was compromised. The company stated on X: “We have handed this matter over to the relevant law enforcement authorities. All affected individuals will be fully compensated.”

Arkham data shows that a wallet address identified as a suspected attacker, 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18, holds approximately $2.65 million worth of POL, the native token of Polygon. The address recently received multiple transfers of POL via the cross-chain exchange service Relay, exchanged from USDC.e (the cross-chain version of the USDC stablecoin).

The first trades began approximately one hour ago, and this wallet has shown no activity in the past five minutes.

Researchers at Hudson Rock stated that a script loaded from DebugBear, a website performance monitoring service, contained code designed to identify active trading sessions of logged-in users, attempt to sell their holdings, and transfer assets.

The company stated that the script hard-coded the same wallet address as a fallback receiving address, and code records from Polymarket’s production site show that the script has been removed. Hudson Rock said it has not yet confirmed how the breach began or how many users were affected.

Polymarket has not yet disclosed the specific cause of this incident. In May of this year, a private key compromise resulted in approximately $700,000 being stolen from its internal deposit wallet. A month later, following a breach of a third-party vendor, hackers injected malicious code into the frontend and stole around $3 million from fewer than 15 accounts; at that time, Polymarket pledged to fully refund affected users.

Editor’s note: This article has been updated since publication to include additional details provided by Polymarket.