Polymarket Halts Trading as Users Report Possible Frontend Compromise

Polymarket stopped new trading and paused wallet transactions on Oct. 29, minutes after users reported that its website may have been compromised and that money was leaving their accounts without permission.

The company has not confirmed a breach or said whether any funds were lost. If the reports hold up, it would be Polymarket's second website attack in four months. A June compromise drained about $3.1 million from user wallets.

Polymarket Pauses Orders and Wallet Transactions

Users in Polymarket's Discord said the frontend may be compromised and assets were being withdrawn without their approval, the crypto news feed Aggr News posted on X at 5:48 p.m. UTC. No loss figure or count of affected wallets has been published.

At 6:05 p.m. UTC, Polymarket's status page reported a major outage: "The exchange is currently in cancel-only mode and relayer actions paused while we investigate an incident." Cancel-only means traders can pull existing orders but cannot place new ones.

The relayer is the Polymarket service that takes transactions a user has signed and sends them to the blockchain, including approvals and transfers, according to the company's documentation. Pausing it stops those requests from going through Polymarket.

The status page still listed the web app, account login and on-chain settlement as operational.

June's Vendor Attack Drained 11 Wallets

On June 25, Polymarket said a third-party vendor had been hacked and malicious code had been slipped into its site for some users.

"We're contacting impacted users & refunding them in full."

Polymarket made that pledge on X after it removed the affected code. Blockchain tracing firm AMLBot later reported that about $3.1 million in pUSD, Polymarket's dollar token, was stolen and converted to ETH. According to multiple industry reports, 11 wallets were drained.

The new incident lands days before Polymarket begins moving new markets to rebuilt smart contracts on Nov. 2. The status page shows the investigation still open, and Polymarket has not said what caused it, whether user funds were taken or whether it will repay anyone.

Update Oct. 29. 6.50 p.m. UTC: Polymarket says a third-party provider was breached. They have now fixed the issue and pledged to reimburse any losses resulting from the compromised frontend.

Further reading: Predict.fun Says $400,000 Was Stolen From User Wallets, Pledges Full Refunds

Treat gambling as entertainment you pay for. 18+, and if it stops feeling like entertainment, help exists at BeGambleAware and GamCare.