Polymarket paused its trading platform after users reported unauthorized asset withdrawals. The platform's status page showed its trading API in major outage and the exchange in cancel-only mode, allowing traders to pull existing orders but not place new ones. Relayer actions, which submit users' signed transactions to the blockchain, were also paused.
Polymarket confirmed that one of its third-party providers was compromised. "We have referred this to relevant law enforcement," the company said on X. "Anyone who has been impacted will be made whole."
Arkham data shows a wallet identified as the suspected attacker's, 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18, holds about $2.65 million in POL, Polygon's native token. The wallet received multiple recent swaps from USDC.e, a bridged version of USDC stablecoin, into POL through Relay, a cross-chain swapping service. The first transactions began about an hour before the report, and the wallet showed no activity in the last five minutes.
Researchers at Hudson Rock said a script loaded from DebugBear, a web performance monitoring service, contains code that looks for a logged-in user's trading session and attempts to sell their positions and transfer assets. The same wallet address is hard-coded in the script as its fallback recipient, and Polymarket's production site code records the script's removal. Hudson Rock said it has not established how the compromise started or how many users were affected.
Polymarket has not yet said what caused the incident. In May, a private key compromise drained roughly $700,000 from an internal top-up wallet. A month later, a compromised third-party vendor let hackers inject malicious code into the frontend and steal about $3 million from fewer than 15 accounts, and Polymarket promised to refund users in full.