At 1:45 p.m. ET on Thursday, a Polymarket trader posting as Car wrote on X: “I just got drained $800,000”. The trader warned other users: “Please be careful dont interact with the site”.
Other traders reported unauthorised withdrawals that afternoon after positions were sold without their consent, leaving accounts short by thousands of dollars. CarOnPolymarket said $800,000 had been taken from his account and that a friend had lost roughly $600,000.
Polymarket halted trading on its international platform after saying a third-party provider had been compromised. Its official status page recorded a major outage affecting the Predictions Trading API at 2:05 p.m. ET.
The platform moved into “cancel-only” mode, which let users cancel outstanding orders while blocking new ones, including orders to sell existing positions. Polymarket said it had taken the step “out of an abundance of caution”.
Polymarket paused relayer actions, which normally submit wallet transactions without users paying network fees, after identifying the provider compromise. The breach stemmed from a hack of DebugBear, a UK-based website performance monitoring platform.
Hudson Rock said a script delivered from DebugBear’s servers was designed to find signed-in Polymarket users, examine their holdings and attempt to dump or transfer them. Dan Zimmermann, chief intelligence officer at Betting Intelligence, said: “This is certainly a significant and new form of breach that we've seen on Polymarket”.
One attacker account withdrew at least $2.7 million across 710 other wallets on Thursday. Outside estimates based on blockchain data put losses at about $2.2 million to $2.65 million.
Polymarket has not said how much was taken in total, how many accounts were affected or which provider was compromised. Its US platform was not compromised.
The company said it had fixed the issue and reopened trading at approximately 3 p.m. ET Thursday. By 7:05 pm UTC, its status page said all systems were operational.
Polymarket said it had referred the matter to law enforcement. “Anyone who has been impacted will be made whole,” the company said.
Users with less than $10,000 taken will have their funds restored by Oct. 30. Those with more than $10,000 withdrawn will need to sign a release form before receiving restoration.
The incident follows a June breach in which hackers drained more than $2.9 million in user funds by compromising a third-party vendor.
Comments (0)