Polymarket has paused trading operations as it investigates a security incident that appears to have compromised the prediction market's frontend, with users reporting that assets were withdrawn from their accounts without permission.

Polymarket, a crypto-based prediction market where users trade on the outcomes of real-world events, placed its exchange in cancel-only mode and paused relayer actions, according to its status page. The trading API is listed in a major outage. Cancel-only mode means traders can pull existing orders but cannot place new ones, while relayer actions — which submit users' signed transactions to the blockchain — are also halted.

Polymarket disclosed the incident in a post on X on October 29, 2026, saying it had identified and fixed an issue affecting its international platform, Polymarket.com, and confirming that one of its third-party providers had been compromised.

"We have referred this to relevant law enforcement," the company said on X. "Anyone who has been impacted will be made whole."

We've identified \u0026 fixed an issue impacting our international platform, Polymarket.com. One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement. Anyone who has been impacted will be made whole. Out of an abundance of caution, we…

— Polymarket Traders (@PolymarketTrade) October 29, 2026

On-chain data from Arkham shows that a wallet identified as the suspected attacker's — 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18 — holds about $2.65 million in POL, Polygon's native token. The address received multiple recent swaps from USDC.e, a bridged version of the USDC stablecoin, into POL through Relay, a cross-chain swapping service. The first transactions began about an hour before publication, and the wallet has shown no activity in the last five minutes.

Researchers at cybersecurity firm Hudson Rock said a script loaded from DebugBear, a web performance monitoring service, contains code that looks for a logged-in user's trading session and attempts to sell their positions and transfer the assets. The firm reported that the same wallet address is hard-coded in the script as its fallback recipient, and that Polymarket's production site code records the script's removal.

Hudson Rock said it has not established how the compromise started or how many users were affected. Polymarket has not yet said what caused the incident. The scope of the incident, the status of the investigation and the process for making affected users whole remain unresolved.

The event marks the latest in a series of security failures at the platform. In May, a private key compromise drained roughly $700,000 from an internal top-up wallet. A month later, a compromised third-party vendor allowed hackers to inject malicious code into the frontend and steal about $3 million from fewer than 15 accounts, and Polymarket promised at the time to refund affected users in full.