The tweet was deleted by the author.
But we saved everything 🙂.
Prediction market platform Polymarket has restored trading following an attack in which hackers allegedly withdrew approximately $2.65 million. The company linked the incident to the compromise of a third-party service provider and pledged to fully reimburse affected users.
On October 29, 2026, Polymarket temporarily restricted trading after detecting suspicious transactions. More than $2.5 million in crypto assets was withdrawn from the platform within minutes, prompting the team to launch an investigation.
View post on X Loading...
Users temporarily lost the ability to open new positions and execute trades. The platform switched the exchange to cancel-only mode and suspended operations through its transaction relayer infrastructure.
According to Arkham data, an address linked to the suspected attacker held approximately $2.65 million worth of POL tokens. Analysts identified several swaps of USDC.e for POL through the Relay service, after which the funds began moving to other addresses.
Initially, the Polymarket team said its investigation was ongoing. Users were allowed to cancel previously placed orders, but new orders and trades were not processed.
The company later announced that it had identified the cause of the incident and resolved the issue. According to Polymarket, the attackers compromised one of its third-party service providers, although the company did not officially disclose its name.
Reuters, citing a source familiar with the matter, reported that the incident may have involved DebugBear, a UK-based website monitoring service. Cybersecurity specialists discovered malicious code that allegedly allowed attackers to exploit active user sessions to sell positions and withdraw cryptocurrency without the owners' consent.
Bubblemaps analysts estimated that approximately 700 users were affected. However, Polymarket has not confirmed this estimate or disclosed the final amount of financial losses.
The company said it had referred information about the incident to law enforcement authorities. After resolving the issue, the platform resumed operations and pledged to fully compensate affected traders for their losses.
This is not the first security incident involving Polymarket. In March 2025, the platform reported a suspected attack on the UMA prediction market resolution mechanism involving a market related to the Ukraine-U.S. minerals agreement.
In May 2026, blockchain investigator ZachXBT identified suspicious withdrawals linked to the UMA CTF Adapter contract on the Polygon network. The company subsequently launched an internal investigation.
Meanwhile, Polymarket continues to expand its offerings in the regulated U.S. market. The company launched five-minute contracts for predicting cryptocurrency price movements, targeting short-term trading.
The new product was introduced amid a review of compliance with regulatory requirements related to a 2022 settlement. In particular, regulators are examining the platform's user onboarding procedures and customer protection mechanisms.
Earlier, we reported that trading activity linked to a Polymarket trader had shifted to a new account on the Polygon network. The changes were identified by tracking transactions associated with the relevant blockchain addresses.