Polymarket, the crypto-based prediction market, briefly stopped new trading on Thursday after users reported that funds were being withdrawn from their accounts without permission.
The platform put its exchange into cancel-only mode, which let traders cancel existing orders but not place new ones. It also paused relayer actions, the service that submits users’ signed transactions to the blockchain.
What Polymarket says
Polymarket later said it had “identified & fixed an issue impacting our international platform, Polymarket.com.” It said a third-party provider had been compromised, but did not name it.
“We have referred this to relevant law enforcement,” the company said. “Anyone who has been impacted will be made whole.”
What researchers found
Cybersecurity firm Hudson Rock said a script loaded from DebugBear, a website performance monitoring service, contained code designed to drain wallets. The code looked for a logged-in user’s trading session and tried to sell their positions and move their funds.
Polymarket’s site code shows the script has since been removed. Polymarket had not confirmed that DebugBear was the compromised provider at the time of writing.
How much was taken
No total had been confirmed at the time of writing. Data from Arkham showed the suspected attacker’s wallet holding about $2.65 million in POL, the token of the Polygon network that Polymarket runs on, after a series of swaps out of USDC.
Some traders have publicly claimed individual losses running into hundreds of thousands of dollars, but those figures have not been verified.
Not the first incident
In May, a compromised private key drained about $700,000 from an internal Polymarket wallet. A month later, hackers used a compromised third-party vendor to inject malicious code into the site and stole about $3 million from fewer than 15 accounts. Polymarket promised full refunds then too.
What happens next
The key details still to come are how many users were affected, the total amount taken, and how quickly Polymarket refunds them.
