From Decrypt · By Jose Antonio Lanz
In brief
Polymarket put its exchange in cancel-only mode and paused relayer actions as users report funds withdrawn without permission.
A wallet flagged as the suspected attacker’s holds about $2.65 million in POL, per Arkham data, after multiple USDC.e-to-POL swaps through Relay.
Hudson Rock says a DebugBear-hosted script containing wallet-draining code hard-codes that same address as its fallback recipient.
Polymarket users are reporting that the prediction market’s frontend may be compromised, with assets being withdrawn from accounts without permission.
The platform’s status page shows its trading API in a major outage and the exchange in cancel-only mode, meaning traders can pull existing orders but not place new ones. Relayer actions, which submit users’ signed transactions to the blockchain, are also paused.
“If you are a Polymarket user, lock down your account,” a trader who goes by CarOnPolymarket said on X. “I just got drained $800,000.”
“Other accounts are also affected,” he said, adding that a friend lost around $600,000. “Please be careful don’t interact with the site.”
If you are a Polymarket user, lock down your account. I just got drained $800,000
Other accounts are also affected. Friend got drained $600k
Please be careful dont interact with the site
— Car (@CarOnPolymarket) October 29, 2026
Polymarket later confirmed that one its third-party providers was compromised. "We have referred this to relevant law enforcement," the company said on X. "Anyone who has been impacted will be made whole."
Arkham data shows that a wallet identified as the suspected attacker’s, 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18, holds about $2.65 million in POL, Polygon’s native token. It received multiple recent swaps from USDC.e, a bridged version of the USDC stablecoin, into POL through Relay, a cross-chain swapping service.
We've identified & fixed an issue impacting our international platform, Polymarket.com. One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement.
Anyone who has been impacted will be made whole.
Out of an abundance of caution, we…
— Polymarket Traders (@PolymarketTrade) October 29, 2026
The first transactions began about an hour ago, and the wallet has shown no activity in the last five minutes.
Researchers at Hudson Rock said a script loaded from DebugBear, a web performance monitoring service, contains code that looks for a logged-in user’s trading session and attempts to sell their positions and transfer the assets.
BitcoinBTC · USD$80,878−0.76%Oct 22Oct 24Oct 26Oct 28Oct 29$82.0k$81.2k$80.4k$79.6k24h HighHigh$81,84024h LowLow$79,636VolVol$1.2B→Buy Bitcoin with USDTPowered by JupiterPrice data by CoinGeckoCoinGeckoMore Bitcoin news and projections →The firm said the same wallet address is hard-coded in the script as its fallback recipient, and that Polymarket’s production site code records the script’s removal. Hudson Rock said it has not established how the compromise started or how many users were affected.