Polymarket Pulls the Plug After Wallet-Drain Reports Turn the Prediction Market into a Rehearsal

Polymarket paused trading and placed its exchange in cancel-only mode after users reported that assets were being withdrawn from accounts without permission. The prediction market’s status page listed its trading API as experiencing a “major outage,” while relayer actions that submit signed transactions to the blockchain were also halted.

The platform later said it had identified and fixed an issue affecting its international platform, with all systems operational as of 7:05 pm UTC. “One of our third party providers was compromised, and we have referred this to relevant law enforcement,” Polymarket said. “Anyone who has been impacted will be made whole.” The status page previously stated: “Out of an abundance of caution, we have temporarily halted trading and are working to bring the platform back online.”

Researchers at Hudson Rock said a script loaded from DebugBear, a web performance monitoring service, contained code designed to locate a logged-in user’s trading session, sell the user’s positions and transfer the assets. The firm said the same wallet address was hard-coded as the script’s fallback recipient and that Polymarket’s production site code records the script’s removal. Hudson Rock said it had not established how the compromise began or how many users were affected.

Arkham data showed that a wallet identified as the suspected attacker’s, 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18, held about $2.65 million in POL, Polygon’s native token. The wallet received several recent swaps from USDC.e, a bridged version of the USDC stablecoin, into POL through Relay, a cross-chain swapping service. The transactions began about an hour before the report, and the wallet showed no activity in the preceding five minutes.

“Other accounts are also affected,” said CarOnPolymarket, a trader who posted on X that they had “just got drained $800,000.” The trader added that a friend lost around $600,000 and advised users not to interact with the site. Polymarket has not publicly identified the third-party provider involved. In May, a private-key compromise drained roughly $700,000 from an internal top-up wallet. A month later, a compromised third-party vendor allowed hackers to inject malicious code into the frontend and steal about $3 million from fewer than 15 accounts, leading Polymarket to promise full refunds.