Polymarket pauses trading after third-party breach drains user wallets

What happened

Polymarket stopped trading on Thursday after users reported that funds were being taken from their wallets, and the prediction market later attributed the incident to the compromise of an outside service provider used by its international platform, Polymarket.com.

As the reports came in, the company moved its international exchange into cancel-only mode, a state in which traders can pull existing orders but cannot submit new ones or execute trades, and it also suspended relayer activity while it examined the cause. In a post on X at 2:33 p.m. ET, Polymarket said it had located and repaired the problem, had passed the matter to law enforcement and would make affected users whole. Trading was running again at roughly 3:00 p.m. ET, and the company said it would reimburse every trader who lost funds.

MetaMask, which offers Polymarket's markets inside its wallet, said its own prediction market users were not exposed, noting that it does not rely on Polymarket's front end or software development kits. Estimates of the damage circulated quickly on-chain, with analysts putting the total somewhere between $2.6 million and $2.7 million.

Why it matters

The episode shows how much of a trading venue's risk sits outside its own code. According to 0xngmi's account, the intrusion ran through a company that handles web performance tracking and whose scripts were being loaded on Polymarket, which would mean anyone visiting the site was potentially exposed simply by showing up. For a platform that has become one of the most closely watched venues for event betting, a front-end supply-chain failure is a reputational problem as well as a financial one, and the promise of full reimbursement puts the company's own balance sheet on the line. Law enforcement was also drawn in within hours of the first reports.

What the data shows

The pseudonymous DeFiLlama developer 0xngmi, cited by Bitcoin.com News, put tracked losses at about $2.7 million and said users' wallet seed phrases remained safe. CryptoPotato reported that blockchain data from Arkham showed a wallet linked to the suspected attacker holding roughly $2.65 million worth of POL after a series of swaps from USDC.e into POL routed through Relay. One affected trader claimed on X to have lost around $800,000, and another account suggested hundreds of transactions fed the total. Those figures came from users and on-chain observers rather than from Polymarket's own accounting.

Background

Polymarket dealt with a separate security failure in May, when roughly $700,000 in cryptocurrency was taken after attackers obtained a six-year-old private key used for internal operations. Bubblemaps reported at the time that the attackers were moving POL tokens across 16 addresses, including exchange addresses. Polymarket confirmed that incident while saying customer funds, smart contracts and market resolution were unaffected, then rotated the key, revoked production permissions and said it would shift its private keys to a more secure management system.

What is still unclear

None of the reports identified the third-party provider at the center of Thursday's incident, and Polymarket has not published its own accounting of the losses. It is therefore not yet known whether the roughly $2.6 million to $2.7 million figure covers every affected user, or whether other websites that loaded the same provider's scripts were also hit.

What to watch

The next signals will be confirmation that reimbursements have actually been paid, disclosure of which provider was compromised and whether other sites using its services were affected. The May breach led Polymarket to overhaul how it stores keys; this one may prompt similar scrutiny of how third-party scripts and front-end dependencies are vetted before they reach traders.

Questions readers ask