Polymarket Paused Trading After a $2.65 Million Exploit — and the Weak Link Wasn't Its Own Code
Prediction markets had their worst day of the year on Thursday — not because traders got a big call wrong, but because someone else's code let an attacker drain user accounts. Polymarket, the world's largest prediction market, halted trading on its international platform on October 29, 2026, after roughly $2.65 million was drained from user accounts in minutes. The platform says it has fixed the issue, referred the matter to law enforcement, and will fully compensate everyone affected. But the incident exposes the uncomfortable truth about crypto's fastest-growing sector: your funds are only as safe as the weakest vendor in the chain.
What happened, hour by hour: The first public signs appeared on Thursday afternoon US time, when Polymarket users reported on X that their accounts were being drained without their approval. One trader said he lost about $800,000; another said a friend lost around $600,000. Polymarket's status page moved fast: at 2:05 PM ET the exchange went into cancel-only mode — traders could pull existing orders but could not place new ones — and relayer actions, which submit users' signed transactions to the blockchain, were paused. Its trading API was flagged as a major outage. By 2:37 PM ET, the platform said one of its third-party providers had been compromised and the matter had been referred to law enforcement. Later updates said the issue had been identified and fixed, that trading would resume at about 3 PM ET, and that all affected users would be made whole. By 7:05 PM UTC, the status page showed all systems operational.
The on-chain trail is unusually clear. Arkham data cited by The Block and Decrypt shows a wallet identified as belonging to a suspected attacker holding about $2.65 million in POL, Polygon's native token, after multiple swaps from USDC.e — a bridged version of the USDC stablecoin — into POL through Relay, a cross-chain swapping service. Security researchers at Hudson Rock added a sharper detail: a script hosted by DebugBear containing wallet-draining code hard-codes that same address as its fallback recipient. Polymarket has not named the provider or given its own total loss figure, and the investigation is still developing.
Why the weak link matters more than the hack: Here is the part that should worry every prediction-market user: nothing in the reporting so far suggests Polymarket's own exchange contracts were broken. The failure arrived through a third party — a provider whose compromise let an attacker reach user funds anyway. That distinction matters for how the industry fixes this. Auditing your own smart contracts is necessary but no longer sufficient when a vendor's script, widget or relayer can become the attack vector. The same week, Coinbase denied a systems breach while saying a vendor had exposed customer data — a different kind of incident, but the same pattern of third-party exposure.
It also lands at a delicate moment for Polymarket. The incident comes two days after reports that the US Commodity Futures Trading Commission reopened its probe into the platform, according to CoinLab's coverage. Prediction markets have surged in popularity since the 2024 US presidential election drove retail engagement, and financial institutions are increasingly seeking exposure to event-driven trading. Robinhood's prediction-market revenue just passed its crypto revenue. Growth and scrutiny are arriving together — and a security incident is the worst possible advertisement in front of regulators.
What to watch from here: Four things decide whether this becomes a footnote or a turning point. First, compensation: Polymarket has pledged to make users whole, and the speed and completeness of those payments is the real test of the promise. Second, attribution: whether the company names the compromised provider and explains exactly how the breach worked — silence here would leave every other platform guessing about its own vendors. Third, scope: the reporting specifies the international platform, polymarket.com, and users should watch for any statement about whether the US venue was affected. Fourth, the regulatory read: a $2.65 million exploit days after a reopened CFTC probe gives critics a concrete example, and the industry's response — third-party audits, vendor allow-lists, tighter frontend security — will be watched as closely as the reimbursement itself. Prediction markets sell themselves as a better way to price the future. Thursday showed they still have to prove they can protect the present.
FAQ: What happened at Polymarket on October 29? The prediction market halted trading on its international platform after roughly $2.65 million was drained from user accounts. The exchange went into cancel-only mode and relayer actions were paused while it investigated. How much was taken? About $2.65 million, per Arkham data cited by The Block and Decrypt: a suspected attacker's wallet holds roughly that amount in POL after USDC.e-to-POL swaps through Relay. Was Polymarket itself hacked? Polymarket says one of its third-party providers was compromised, and it has referred the matter to law enforcement. It says the issue on its international platform has been identified and fixed. Will users get their money back? Polymarket says anyone impacted will be made whole. The speed and completeness of compensation is still to be confirmed. Is trading back? The platform said trading would resume at about 3 PM ET on October 29, and its status page showed all systems operational by 7:05 PM UTC. How is this different from the Bithumb breach? The Bithumb incident exposed customer and staff data but no funds were reported lost. The Polymarket incident drained user funds — about $2.65 million — which is why the platform halted trading and pledged compensation.
For more market news and discussion, follow Zimbuck News at https://zimbuck.com/pages/zimbucknews and join the Zimbuck Market News group at https://zimbuck.com/groups/zimbuckmarketnews. Related reading on the site: https://zimbuck.com/blogs/351/Allium-Breach-The-Blockchain-Data-Provider-Behind-Visa-Stripe-and
This article is market news and general information only, not financial advice.
