Polymarket Halts Trading After Third-Party Breach Drains User Accounts

Trading Halted on the International Venue

Polymarket suspended all trading on its international venue on Thursday after a third-party provider was compromised and users reported seeing their accounts drained. According to the company's status page, the issue affecting Polymarket.com has been identified and fixed, the compromised provider has been referred to relevant law enforcement, and affected users will be “made whole.” The exchange did not disclose how many accounts were hit or the total value taken. The suspension covers the wallet-based international service, where users trade prediction markets from self-custodial accounts; the separately regulated US exchange, which runs under a Commodity Futures Trading Commission (CFTC) license, is not named as an affected venue. A community-run account posted a near-identical statement on X shortly after the status page update, matching the official wording. As of publication, no timetable for restoring full trading had been given.

@PolymarketTrade · X post

Near-identical statement on X.

View on X

Cancel-Only Mode at 18:05 UTC

The status page first flagged the incident at 18:05 UTC on Thursday, classifying it as a major outage of the Predictions Trading API, the order book that matches prediction-market trades. At that stage the exchange sat in cancel-only mode: users could cancel existing orders, but no new orders or trades were processing, and relayer actions, the service that submits on-chain transactions on users' behalf, stayed paused. Account access, websocket feeds, position data and Polygon settlement kept running throughout. About 32 minutes later, at 18:37 UTC, the page moved from “investigating” to “identified” and attributed the fault to the compromised third-party provider. The only permitted order types were cancellations of open orders while the matching engine stayed dark, leaving traders with live exposure unable to exit.

User Losses and the $2.68M Claim

Drain reports began circulating on X before the company confirmed anything. A trader using the name Car said in a post on X that $800,000 was taken from his account and that a friend lost $600,000, adding that all his positions were sold. A separate account, StarPlatinum, traced a suspected recipient wallet that began receiving funds at 17:05 UTC, held $412,000 by 17:25, reached $2.02 million at 17:50 and peaked at $2.68 million at 18:05, while estimating the recipient accumulated 28.6 million POL converted from user deposit balances. That account also identified a Deposit Wallet Factory proxy and alleged that Relay's sponsored-transaction infrastructure was involved. None of these figures is confirmed: the company's statements name no victim count, no loss total and no attacker address, and no transaction hash has been published.

@CarOnPolymarket · X post

Post on X.

View on X

June's Frontend Attack and a Refund Precedent

The episode mirrors a June incident in which a compromised third-party vendor allowed a malicious script into Polymarket's frontend for some users. Early on-chain analysis put that loss at $2.94 million across at least 11 wallets, with a later estimate reaching $3.1 million; funds were taken in pUSD on Polygon, converted through Relay, bridged to Ethereum and swapped into ETH. The company said at the time that it had removed the affected dependency and would reimburse affected customers in full. A peer platform suffered a similar breach days earlier: Predict.fun confirmed unauthorized transfers of roughly 400,000 USDT in a statement on Oct. 27, tracing a possible compromise of an externally hosted API documentation site, and promised full reimbursement plus a detailed post-mortem. A December incident involving a one-click login service pointed to the same weak link, third-party dependencies.

A Repeating Third-Party Pattern

Three incidents in roughly ten months, all routed through vendor dependencies rather than the on-chain contracts, point to a structural weakness in the prediction-market stack. Polymarket runs on Polygon, a Layer 2 network, and long since moved from its early automated market maker design to a central order book, yet the attack surface sits in hosted frontends, relayers and deposit-wallet infrastructure that no contract audit covers. In each case funds left the moment users signed malicious requests, so losses hardened at confirmation time. The company's fix-and-compensate posture is consistent, but it has again published no transaction hashes, no confirmed loss figure and no technical root cause beyond naming a third party. Until those details land, moving idle balances to a cold wallet and reviewing how hardware wallets work remains the practical defense for active users.