Polymarket pauses trading after third-party provider is compromised

Key points

• Polymarket's trading API suffered a major outage and the exchange moved to cancel-only mode, with relayer actions paused.
• A wallet identified as the suspected attacker's holds about $2.65m in POL after swaps from USDC.e through Relay, per Arkham.
• Hudson Rock says a script loaded from DebugBear contained wallet-draining code naming that same address as its fallback recipient.

Polymarket paused trading after a security incident at a third-party provider, with users reporting that funds were withdrawn from their accounts without permission. Relayer actions, which submit users' signed transactions to the blockchain, were also paused.

Polymarket later confirmed that one of its third-party providers had been compromised and said it had referred the matter to law enforcement. The company said anyone affected would be made whole. A trader posting as CarOnPolymarket said on X that $800,000 had been drained from their account and that a friend had lost about $600,000, urging users not to interact with the site.

Arkham data shows a wallet identified as the suspected attacker's, 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18, holding about $2.65m in POL, Polygon's native token.

Polymarket has not said what caused the incident.

What to watch: Polymarket has not said when trading will resume or what caused the incident.

Read the full story on Decrypt →