Quick answer: The Polymarket hack on Oct. 29, 2026 drained about $2.65 million to $2.7 million from users of its international platform after a third-party provider was compromised. Polymarket put its exchange in cancel-only mode, paused relayer actions, referred the case to law enforcement and said affected users will be made whole.
The Polymarket hack on Thursday drained roughly $2.7 million from user accounts on the prediction market’s international platform. Polymarket says a third-party provider was compromised, and it has promised to make every affected user whole.
The platform switched its exchange to cancel-only mode while it investigated. As a result, traders could pull open orders but could not place new bets.
What happened in the Polymarket hack?
Users first raised the alarm on X. They said their positions were being sold and their funds withdrawn without their approval. CoinDesk confirmed that users with balances on Polymarket’s international venue saw their accounts drained.
Soon after, Polymarket’s status page showed a major outage on its trading API. The exchange moved to cancel-only mode, and relayer actions were paused, according to The Block and Decrypt. Relayers are the service that submits users’ signed transactions to the blockchain. Pausing them stops further on-chain moves from the app.
Polymarket then said it had found and fixed the cause. “One of our third party providers was compromised, and we have referred this to relevant law enforcement,” the company said, adding that anyone impacted “will be made whole.” Cointelegraph reported that the status page listed all systems as operational as of 19:05 UTC.
How much was stolen?
Two data points line up closely. Arkham data shows a wallet flagged as the suspected attacker’s holding about $2.65 million in POL, Polygon’s native token, as both The Block and Decrypt reported. That wallet received several swaps from USDC.e, a bridged version of USDC, into POL through the cross-chain service Relay. The funds were later moved to other addresses.
Meanwhile, CoinDesk cited DeFi Llama tracking about $2.7 million in losses. One trader posted on X that he had lost $800,000. However, that figure is his own claim and has not been confirmed by Polymarket.
POL traded at $0.0920 on CoinGecko at 19:57 UTC on Oct. 29, 2026, down about 0.5% over 24 hours. So the swaps did not move the token much. Bitcoin was at $80,801 at the same time.
How did attackers get in?
Polymarket has only said that a third-party provider was compromised. It has not named the vendor.
Researchers at Hudson Rock offered an early lead, according to Decrypt. They said a script loaded from DebugBear, a web performance monitoring service, contained code that looked for a logged-in user’s trading session. It then tried to sell that user’s positions and send the assets out. The same attacker wallet was reportedly hard-coded in the script as a fallback recipient. Hudson Rock also said it has not established how the compromise started or how many users were hit. Treat this as unconfirmed until Polymarket publishes its own post-mortem.
Why this Polymarket hack matters
This is not the first time a vendor has caused losses on Polymarket. In June, another compromised third-party vendor let hackers inject malicious code into the front end and take about $3 million from users, as CoinDesk and Decrypt both reported. Decrypt adds that a private key compromise drained around $700,000 from an internal top-up wallet in May.
Our read: the smart contracts were not the weak point here. Instead, the risk sat in the web layer, where outside scripts run inside a logged-in session. That is a real problem for an app that wants mainstream users. Most traders never check which third-party code loads on a page, and they should not have to.
The timing is also awkward. Polymarket has been pushing into the US, including the 5-minute crypto markets we covered this week. Rival Kalshi is under pressure of its own, after Utah filed criminal charges against the company. In other words, trust is now the main thing these platforms are competing on.
It also fits a wider pattern of vendor-driven leaks this month. For example, see our report on the Coinbase data breach tied to a vendor.
What to watch next
- Refunds: how and when Polymarket makes users whole, and whether it covers everyone.
- Post-mortem: whether the company names the provider and confirms the script theory.
- Fund tracing: whether the moved POL can be frozen or traced to an exchange.
- Vendor controls: whether Polymarket cuts outside scripts from logged-in pages.
Until then, users should log out, review recent activity and avoid signing unexpected prompts. Our guide on keeping your seed phrase safe covers the basics.
Polymarket Hack FAQ
Were Polymarket’s smart contracts hacked?
No evidence points to that so far. Polymarket blamed a compromised third-party provider, and early research points to a malicious web script rather than an on-chain bug.
Will Polymarket refund affected users?
Yes, according to the company. Polymarket said anyone impacted “will be made whole,” but it has not yet shared details or a timeline.
Was Polymarket’s US platform affected?
CoinDesk reported that the losses hit users on Polymarket’s international platform, and Polymarket’s own statement referred to the international site, Polymarket.com.
Not financial advice. Crypto assets and prediction markets are high-risk; DYOR before investing.
Sources
- CoinDesk: Polymarket suspends trading after third-party breach leads to user losses
- The Block: Polymarket pauses trading after $2.65 million exploit
- Decrypt: Polymarket pauses trading as it investigates security incident
- Cointelegraph: Polymarket suspended trading amid reports of user funds being drained
- CoinGecko: POL price
