Polymarket halted trading on the evening of October 29 after the theft of about $2.65 million from user accounts. The money left through a compromised third-party contractor in a matter of minutes. The platform switched the exchange to cancel-only mode.
Polymarket is the largest prediction platform. There, people buy and sell contracts on the outcome of an event: elections, a match, a regulator's decision. The money sits in the trader's own wallet, not in an exchange account.
Why this matters to a trader. The account was emptied while the person was simply on the site with a connected wallet. The platform promises to fully reimburse the losses.
Where did the money go?
The funds were collected at a single address. According to the analytics service Arkham, the address 0x3F99...fc18 held about $2.65 million in POL. POL is the base token of the Polygon network.
- USDC.e - the money was exchanged out of this stablecoin through a series of transactions
- Relay - a cross-chain service through which the exchanges went
- Other wallets - the funds were dispersed there after the exchanges
Reported losses. A trader under the handle CarOnPolymarket reported a debit of $800,000 - this is the largest reported loss. An acquaintance of his lost about $600,000. The users' amounts have not been independently confirmed.
Why did this happen?
The cause was found in someone else's code. According to Hudson Rock, a malicious script was loaded from DebugBear. This is a website speed monitoring service.
- Session search. The code looked for an active trading session of a logged-in user.
- Selling off positions. The script sold the trader's open positions.
- Withdrawing assets. The money went to that very address hardcoded in the script.
The script was removed. It has already been deleted from the site's working code.
What is the platform's status now?
New orders are not going through. You can only cancel your own orders; the trading interface is in a major outage. The relayer's operation has also been halted (this is a service that sends user-signed transactions to the blockchain).
Key point: Polymarket confirmed the compromise of one of its third-party providers, handed the case to law enforcement, and stated that affected users will be fully reimbursed for their losses.
Has this happened before?
This is the third such incident in a year. The contractor scheme keeps repeating, and each time it is the traders' own wallets that suffer.
- May. Through a private key leak from an internal funding wallet, about $700,000 was drained.
- June. Through a contractor, malicious code was injected into the site and about $3 million was withdrawn from fewer than 15 accounts - the money was returned that time.
An alternative for volume. If you don't want to keep your capital on the platform, you can find a challenge that suits your trading style and understand how payouts work.
Is your money sitting on someone else's server?
The worst part here isn't even the amount, but the mechanics. The account was emptied by a script from a third-party service. Meanwhile, the trader was simply sitting on the site with a connected wallet. And to trade meaningful volume, you have to keep your capital right there. In prop trading, the trading nominal is provided by the company: you pay for the evaluation, work within its limits, and take a share of the profit. It makes more sense to understand this scheme before the next platform goes into cancel-only mode.