Polymarket halted trading on October 29, 2026, after users reported unauthorized asset withdrawals from their accounts. The platform's trading API entered a major outage and shifted to cancel-only mode, allowing traders to pull existing orders but not place new ones. Relayer actions, which submit signed transactions to the blockchain, were also paused.
Polymarket confirmed that one of its third-party providers was compromised. "We have referred this to relevant law enforcement," the company stated. "Anyone who has been impacted will be made whole."
Arkham data identified a suspected attacker wallet, 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18, holding approximately $2.65 million in POL, Polygon's native token. The wallet received multiple recent swaps from USDC.e, a bridged version of USDC, into POL through Relay, a cross-chain swapping service. The first transactions began about an hour before the incident was reported, with no activity in the five minutes following.
Hudson Rock researchers discovered that a script loaded from DebugBear, a web performance monitoring service, contains code designed to locate a logged-in user's trading session, sell their positions, and transfer assets. The same wallet address appears hard-coded in the script as its fallback recipient. Hudson Rock stated it has not established how the compromise began or how many users were affected.
Polymarket has not disclosed the incident's cause. In May 2026, a private key compromise drained roughly $700,000 from an internal top-up wallet. A month later, a compromised third-party vendor allowed hackers to inject malicious code into the frontend and steal about $3 million from fewer than 15 accounts, which Polymarket refunded in full.