Polymarket put its exchange into cancel-only mode and paused relayer actions on October 29, 2026, after users reported unauthorized fund withdrawals. Trader CarOnPolymarket disclosed on X that $800,000 was drained from their account, with another $600,000 lost by an associate. A suspected attacker’s wallet holds $2.65 million in POL following USDC.e-to-POL swaps, according to Arkham blockchain analytics data.
“If you are a Polymarket user, lock down your account. I just got drained $800,000,” CarOnPolymarket wrote. “Other accounts are also affected. Friend got drained $600k. Please be careful don’t interact with the site.”
Security research firm Hudson Rock identified a malicious script loaded from web performance monitoring service DebugBear that targeted logged-in users’ trading sessions. The script contained code to sell positions and transfer assets, with the suspected attacker’s wallet address hard-coded as a fallback recipient. Polymarket’s production site code records the script’s removal.
The first suspicious transactions began approximately one hour before CarOnPolymarket’s public report. As of the article’s time, the suspected attacker’s wallet showed no activity in the preceding five minutes.
Polymarket’s trading API is in major outage. The exchange’s cancel-only mode allows order cancellation but blocks new order placement. Relayer actions, which submit signed user transactions to blockchain, remain paused.
Hudson Rock has not established how the compromise began or how many users were affected. Polymarket has not stated what caused the incident.
This marks the third security incident at Polymarket in under six months. In May 2026, a private key compromise drained $700,000 from an internal top-up wallet. In July 2026, a compromised third-party vendor allowed malicious code injection into the frontend, stealing $3 million from fewer than 15 accounts. Polymarket promised full refunds for that breach.
