Polymarket pauses trading after $2.65 million exploit

Polymarket paused trading and placed its exchange in cancel-only mode after users reported funds being withdrawn without permission. The platform stated that over $2.5 million was lost within minutes of the incident. Users claimed online that their accounts were drained of thousands of dollars after positions were sold without consent. Polymarket confirmed that one of its third-party providers was compromised and referred the matter to law enforcement. The company stated that anyone impacted by the incident will be made whole.

A wallet flagged as the suspected attacker's holds approximately $2.65 million in POL tokens. The suspected attacker's wallet received multiple swaps of USDC.e to POL through Relay. Hudson Rock identified a DebugBear-hosted script containing wallet-draining code that hard-codes the attacker's address as its fallback recipient. Hudson Rock researchers stated they have not established how the compromise started or how many users were affected. The first transactions related to the exploit began about an hour before the report was written.

A trader named CarOnPolymarket reported being drained of $800,000 and advised other users to lock down their accounts. CarOnPolymarket reported that a friend lost around $600,000 in the incident. Polymarket previously suffered a private key compromise in May that drained roughly $700,000 from an internal top-up wallet. Polymarket previously suffered a compromised third-party vendor incident in June that allowed hackers to steal about $3 million from fewer than 15 accounts.

Polymarket reported that its Predictions Trading API experienced a major outage. Polymarket suspended trading on Thursday after identifying and fixing an issue impacting its operations. As of 7:05 pm UTC, Polymarket reported that all its systems were operational.