Third-Party Breach Triggers Trading Freeze
On Thursday, Polymarket, a leading prediction markets platform, abruptly suspended trading after a significant security incident led to user losses totaling more than $2.5 million.
The incident unfolded rapidly, with users reporting the unauthorized draining of their accounts as positions were sold off without their consent. As the attack became apparent, Polymarket shifted its exchange into "cancel-only" mode—a state where users could cancel existing orders but not place new ones—while engineers worked to contain the exploit and assess the damage.
A major outage in Polymarket's Predictions Trading API was first reported on Thursday before 7:05 pm UTC, when the company confirmed its systems were operational again.
Users Report Accounts Drained Rapidly
Several users claimed losses in the thousands of dollars, with some seeing their entire balances vanish almost instantly. One wallet suspected to belong to the attacker, identified as 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18, was found holding approximately $2.65 million in POL tokens after a series of suspicious transactions. These funds were moved via Relay, a cross-chain swapping service, and traced back to unauthorized sales of user positions triggered by malicious scripts loaded through compromised frontend code.
For many affected traders, their assets were gone before they even knew an attack was underway.
Researchers at Hudson Rock discovered that a script loaded from DebugBear was responsible for selling off user positions and transferring assets directly to the attacker’s wallet address. However, it remains uncertain how this malicious code was introduced or exactly how many accounts were ultimately compromised during the breach.
Cancel-Only Mode Follows Exploit Discovery
In response to the exploit, Polymarket’s technical team quickly transitioned the platform into cancel-only mode to prevent further unauthorized activity. This emergency measure allowed users to cancel open orders but stopped new trades from being executed while security teams investigated the full scope of the breach. According to cointelegraph.com, by 7:05 pm UTC on Thursday—all times precise—Polymarket reported that its systems were once again operational and trading had resumed after critical fixes were applied.
The contrast between the speed of the exploit—over $2.5 million drained within minutes—and the hours-long recovery process highlights just how vulnerable even established crypto platforms can be when third-party vendors are compromised. While technical operations returned to normal by Thursday evening, trust among users remains shaken as details about how attackers gained access continue to emerge.
See Also
Compromised Vendor at Incident’s Core
The attack did not originate from Polymarket’s own infrastructure but rather from a third-party provider whose systems were breached. This vendor compromise allowed malicious actors to inject code that manipulated frontend interactions and facilitated unauthorized withdrawals from user accounts.
Polymarket has referred the matter to law enforcement as part of its ongoing investigation into both the mechanics and perpetrators behind the hack. The company has not yet disclosed which third-party provider was targeted or provided technical specifics about how access was obtained, leaving some uncertainty around whether similar vulnerabilities persist elsewhere in DeFi markets.
Polymarket Promises to Reimburse Victims
In an attempt to restore confidence following this high-profile incident, Polymarket publicly committed to making all impacted users whole. The company stated that anyone who suffered losses due to this exploit would be reimbursed in full—a pledge that could cost upwards of $2.65 million based on current estimates tied directly to the attacker’s wallet balance.
This isn’t the first time Polymarket has faced such challenges; in June, hackers managed to drain more than $2.9 million from user accounts by compromising another third-party vendor linked to its services. That recurring pattern raises tough questions about dependency risks in decentralized finance: robust smart contracts alone may not protect against vulnerabilities introduced through external service providers.
While Polymarket’s swift return to operational status offers some reassurance for active traders, it is clear that platform security remains an open question—especially when third-party integrations are involved. For now, affected users await reimbursement as investigations continue and industry observers scrutinize how quickly lessons will be learned from yet another costly breach.
Key points still in play
If Polymarket follows through on its statement that "anyone impacted will be made whole" after the $2.65 million exploit linked to a third-party provider breach, immediate user restitution can be expected, but the exact process and timeline for compensation remain unclear as of the trading resumption after 7:05 pm UTC on Thursday.