Polymarket Restores Trading After $2.7M Third-Party Security Breach
Key Takeaways
- •Polymarket restored trading on its international platform after a several-hour outage that began with a shift into cancel-only mode, allowing users to withdraw existing orders while new trades halted.
- •Blockchain analytics firm Bubblemaps estimates approximately $2.7 million was stolen from roughly 700 users, a figure Polymarket has not confirmed.
- •Researchers linked the breach to malicious code embedded in a UK-based website performance-monitoring service, an attack pattern known as a supply-chain attack, and the exact method remains under investigation.
- •Polymarket US, the federally regulated platform for American users, was unaffected, and the company said its own website was not breached while UK law enforcement was notified.
- •Polymarket has promised full reimbursement but has not disclosed a timeline or claims process, and the incident exceeds the more than $2 million in losses from a June 2026 breach.
Polymarket has restored trading on its international platform following a security incident at an outside service provider on October 29, with the company saying that traders who lost money in the breach will be fully reimbursed. Blockchain analytics firm Bubblemaps estimates that approximately $2.7 million was stolen from roughly 700 users, though Polymarket has not confirmed that figure.
Researchers have linked the attack to malicious code embedded in a website performance-monitoring service. Polymarket US, the company's federally regulated platform for American users, was not affected.
How the Trading Pause Unfolded
Polymarket's response began with a shift into cancel-only mode, which allowed customers to withdraw existing orders while new trades stopped processing. The company also paused the service that submits transactions on behalf of users before disclosing that one of its third-party providers had been compromised.
Trading remained paused for several hours while the company investigated. A later update from the Polymarket Traders account on X confirmed that trading was fully back online.
According to the company, the breached vendor is based in the United Kingdom. Polymarket said its own website was not breached and that UK law enforcement has been notified. The episode shows how a platform's day-to-day operations can be disrupted through a vendor even when its own infrastructure stays untouched.
The hack did not affect Polymarket US, the newer platform that operates as a federally regulated exchange for people in the United States. The flagship international platform is cryptocurrency-based and is banned in the United States and several other countries.
Tracing the Stolen Funds
Bubblemaps traced funds from hundreds of deposit wallets into an address it identified as belonging to the attacker. Its diagram showed 712 deposit wallets and about $2.71 million moving through the main route.
Polymarket Drain Report
A third party provider from Polymarket was compromised
700+ users drained and $2.7M stolen
Main attacker: 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18
Funds converted to $POL and sent out to:
$1.4M 0xe4C4C39C1733e1C7c06B79f97ED442B68Df41EC6
$523k… pic.twitter.com/XF7Cxz2GdH
— Bubblemaps (@bubblemaps) October 29, 2026
The firm said the stolen funds were converted into POL, the native token of Polygon, and sent to several addresses. It also tracked transfers to Ethereum.
How the Attack Worked
Researchers linked suspicious code to a website performance-monitoring service. These tools normally help companies see how their websites load and function. Breaches that arrive through a vendor's code rather than a company's own systems are commonly known in the industry as supply-chain attacks, and embedded third-party scripts have long been a familiar attack vector for web platforms. According to the researchers, the malicious code accessed users' trading sessions and initiated actions that moved assets out of their accounts. The exact attack method is still under investigation.
On X, several prominent traders said they had lost money. Polymarket declined to tell WIRED how many traders were affected or how much was lost.
Prior Incidents and a $1 Billion Funding Round
This is not the platform's first breach. In June 2026, another incident led to more than $2 million in losses for affected traders. At Bubblemaps' estimate, the latest incident would exceed that total. The company has faced controversy since its 2020 launch, including alleged insider trading cases that led to arrests; the suspects in those cases have pleaded not guilty. The platform allows users to trade on the outcomes of real-world events.
In August 2026, Polymarket raised $1 billion in a funding round led by 1789 Capital, where Donald Trump Jr. is a partner. The company is now valued at $21 billion.
Refunds Promised, Details Pending
Polymarket has promised full repayment but has not shared a timeline or claims process. Users are waiting for details on which accounts qualify, how losses will be calculated, and when funds will be returned. The open questions — the exact attack method, the final loss tally, and the mechanics of reimbursement — now sit with Polymarket's ongoing investigation, with UK law enforcement also notified. A full analysis of the incident is expected from the Polymarket team.
Source: Blockonomi
