Polymarket suspended trading operations and entered cancel-only mode on October 29, 2026, following reports of unauthorized fund withdrawals from user accounts. The prediction market platform confirmed that a third-party provider was compromised, leading to the immediate pause of relayer actions which submit signed transactions to the blockchain. Users reported significant losses, with one trader citing an $800,000 drain and another account losing approximately $600,000. Polymarket stated it has referred the incident to law enforcement and pledged to make impacted users whole.
Security researchers identified a wallet address holding about $2.65 million in POL, Polygon’s native token, as belonging to the suspected attacker. This wallet received multiple swaps from USDC.e into POL via Relay shortly before the activity ceased. Hudson Rock analysts discovered that a script hosted by DebugBear, a web performance monitoring service, contained malicious code designed to detect logged-in sessions, sell positions, and transfer assets to the hard-coded attacker address. The firm noted that Polymarket’s production site logs recorded the removal of this script but did not establish the initial vector of compromise or the total number of affected users.
This incident marks the second security breach for Polymarket in recent months. In May 2026, a private key compromise drained roughly $700,000 from an internal top-up wallet. Subsequently, a compromised third-party vendor allowed hackers to inject malicious code into the frontend, stealing about $3 million from fewer than 15 accounts. Polymarket has not yet disclosed the specific cause of the current outage beyond confirming the third-party provider involvement.
The suspension of Polymarket’s trading API highlights the fragility of decentralized finance platforms that rely heavily on centralized frontends and third-party infrastructure. While the protocol layer may remain secure, the user experience is vulnerable to supply chain attacks through seemingly benign services like web performance monitors. The rapid detection and isolation of the malicious script suggest effective internal monitoring, but the reliance on external providers for critical path functions introduces systemic risk that extends beyond smart contract vulnerabilities.
From an Operational Risk perspective, the recurrence of third-party compromises within six months raises questions about vendor due diligence and architectural resilience. The promise to reimburse users mitigates immediate financial loss for customers but does not address the reputational damage or the potential regulatory scrutiny regarding consumer protection standards in prediction markets. Future incidents will likely test whether Polymarket can decouple its core transaction submission mechanisms from potentially vulnerable peripheral services.
