Skip to content
EVENT / TOPICActive

Polymarket Halts Trading After Third‑Party Breach and User Funds Drain

6 reports6 sources10/30/2026 updated

Current overview (not historical)

AI overview

Polymarket suspended all new trades on October 29, 2026 after users reported unauthorized withdrawals totaling roughly $1.4 million. Traders on X warned that their accounts lost $800,000 and that a friend’s account lost $600,000, prompting the platform to switch to a cancel‑only mode. The company later claimed that its exchange was operated by a third‑party provider that had been compromised, and it announced that trading had resumed. Arkham Analytics identified the attacker’s wallet holding about $2.65 million in POL tokens. CryptoSlate reported that more than 700 users’ assets—approximately $3.46 million—were affected, with $2.7 million in POL transferred out and $750,000 remaining on the platform. The incident illustrates the risks of outsourcing exchange infrastructure and the rapid escalation of losses when a single breach can drain millions of dollars from user accounts.

Written with AI from the reporting · updated 10/30/2026

Latest developmentOct 30, 18:30
Polymarket Suffers Second Multi‑Million Dollar Breach in Four Months

EventGraph Explorer

One time cutoff for reports, relations and evidence.

EVENTGRAPH EXPLORER
Open in the standalone explorer ↗
EVENT REPLAYStep 6 / 6

New at this step ·Polymarket Suffers Second Multi‑Million Dollar Breach in Four Months

Reports in replay
6
First-party
0
Sources
6

Reports first seen at this step · 1

Discovery-time replay; the linked graph and evidence share this cutoff. The full overview and activity remain current.

Event developments

4 developments

  1. 10/30/2026, 3:05:11 AM

    Polymarket halts trading after security incident, users report unauthorized withdrawals

    Decrypt

  2. 10/30/2026, 3:22:12 AM

    Polymarket halts trading after users report $1.4 million drained from accounts

    BeInCrypto

  3. 10/30/2026, 3:45:11 AM

    Polymarket suspends trading amid reports of user funds being drained

    Cointelegraph

  4. 10/30/2026, 6:35:12 PM

    Polymarket Suffers Second Multi‑Million Dollar Breach in Four Months

    CryptoSlate

Filtered by first discovery; only representative reports already discovered by this cutoff are shown. Story grouping may have changed later, so this is not a complete historical snapshot.

Bounded reconstruction, not an exact snapshot: entity names, relationship text and story grouping may include later revisions. Overview and full source archive below remain current.

Story route

A station-by-station route from the first public evidence onward; every station carries its own evidence and uncertainty.

  1. 1Oct 29, 00:00recorded Oct 30, 03:05revised

    Polymarket暂停交易并调查安全事件

    Read original source ↗ DecryptReplay this moment in the explorer
  2. 2Oct 29, 00:00recorded Oct 30, 03:22single source

    Polymarket halts trading after $1.4 million drain reports

    Read original source ↗ BeInCryptoReplay this moment in the explorer
  3. 3Oct 30, 00:00recorded Oct 30, 03:45single sourcerevised

    Polymarket暂停交易

    Read original source ↗ CointelegraphReplay this moment in the explorer
  4. 4Oct 29, 00:00recorded Oct 30, 18:35single sourcerevised

    Polymarket suffers second multimillion-dollar security breac

    Read original source ↗ CryptoSlateReplay this moment in the explorer

Uncertainty marks flag where to check the sources; they are not proven causation.

Full source archive (current)

Current public reports; outside the historical replay.

First-party sources · 0 reports

No verifiable reports in this group yet.

Independent coverage · 6 reports

Different reports do not necessarily disagree. Check original sources and publication dates.

Report timeline

Explore every side through dated source reports.

Oct 30
  1. CryptoSlateSelected
    Polymarket Suffers Second Multi‑Million Dollar Breach in Four Months

    Polymarket’s trading platform was shut down on Oct. 29 after a malicious third‑party script infiltrated the site’s login session, searching for trading tools and requesting signatures. Blockchain analytics firm Bubblemaps estimated that more than 700 users were affected, with about $3.46 million of assets compromised. Roughly $2.7 million was converted to POL and transferred out, while $750,000 remained on the platform. The October breach followed an earlier June attack in which a compromised vendor’s script used approved authorizations to drain approximately $3 million from users’ wallets via Polymarket’s own relayer. Both incidents demonstrate how external scripts can access a user’s browser context, obtain cryptographic signatures, and move funds, raising questions about the boundary between third‑party code and the platform’s internal signing mechanisms.

  2. Cointelegraph
    Polymarket suspends trading amid reports of user funds being drained

    Polymarket has paused all trading activity following reports that user funds were drained. The platform stated it is investigating the fund flows and will resume operations only after resolving the issue.

  3. The Block
    Polymarket resumes trading after $2.65 million exploit, says third-party provider was compromised

    Polymarket resumed trading after a $2.65 million exploit that forced the platform into cancel-only mode. The platform attributed the incident to a compromise of its third-party exchange provider.

  4. CoinDesk
    Polymarket suspends trading after third-party breach leads to user losses

    Polymarket suspended trading following a breach of a third-party provider that resulted in user account losses. The platform confirmed the incident affected some users.

  5. DecryptSelected
    Polymarket halts trading after security incident, users report unauthorized withdrawals

    Polymarket paused trading and relayer actions after users reported unauthorized fund withdrawals. A wallet flagged as the suspected attacker holds about $2.65 million in POL after multiple USDC.e-to-POL swaps through Relay. Hudson Rock found a DebugBear-hosted script with wallet-draining code hard-coded to the same address. The platform's frontend may be compromised, with the trading API in major outage and the exchange in cancel-only mode.

  6. BeInCrypto
    Polymarket halts trading after users report $1.4 million drained from accounts

    Polymarket halted all new trading on October 29 after a trader warned $800,000 was drained from his account and a friend lost $600,000, bringing reported losses to $1.4 million. The company has not confirmed a hack, but moved to cancel-only mode while investigating. The incident follows a $3 million attack in June and a $400,000 loss at rival Predict.fun days earlier.

Event activity trend

Latest comparable
23
Comparable peak
4910月30日 04:00
24h change
-34%

The chart compares consistently observed participants only. Hover or tap to inspect each hour; use arrow keys to move between observations.