decrypt.coarticlePolymarket Pauses Trading as Prediction Market Investigates Security Incident
Polymarket put its exchange in cancel-only mode and paused relayer actions on 29 October 2026 after users reported funds withdrawn without permission. Hudson Rock says a DebugBear-hosted script holds wallet-draining code that sells a logged-in user's positions and hard-codes the suspected attacker's wallet (about $2.65 million in POL, per Arkham) as fallback recipient. Polymarket blames a compromised third-party provider and promises to make users whole. Root cause and victim count are unconfirmed.
What it is
On 29 October 2026 Polymarket.com, the international platform, was hit by a frontend compromise that Polymarket attributes to one of its third-party providers. Hudson Rock points to a script loaded from DebugBear, a web performance monitoring service. The page does not say how the compromise began or how many users lost funds.
How it works
According to Hudson Rock, the script looks for a logged-in user's trading session, tries to sell their positions, and transfers the assets out. The suspected attacker's address is hard-coded in it as the fallback recipient. Hudson Rock also says Polymarket's production site code records the script's removal.
On-chain, Arkham data shows the wallet received several USDC.e-to-POL swaps through Relay, a cross-chain swapping service. It now holds about $2.65 million in POL. The first transactions began about an hour before the article was written, and the wallet had been idle for the last five minutes.
Preconditions / Affected
The page names Polymarket.com users with an active logged-in session. Relayer actions, which submit users' signed transactions to the blockchain, are paused. The exchange is in cancel-only mode, so traders can pull existing orders but not place new ones.
What to do
The page gives no user-side remediation. Polymarket says it has referred the matter to law enforcement and that affected users "will be made whole." For monitoring, the suspected attacker address is:
0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18Caveats
Hudson Rock has not established how the compromise started or how many users were affected. Polymarket has not said what caused the incident. The DebugBear link comes from Hudson Rock, while Polymarket says only "a 3rd party provider." The page notes two earlier incidents. In May 2026 a private key compromise drained about $700,000 from an internal top-up wallet. A month later a compromised third-party vendor allowed malicious frontend code that stole about $3 million from fewer than 15 accounts, and users were refunded in full.
Organisations named here
- 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18
- Polymarket
- third-party script compromise
Technologies named here
- Arkham
- Hudson Rock
- Polygon
- DebugBear
- Relay
Techniques named here
- Supply chain compromise
- Cryptocurrency swapping to launder proceeds
- Malicious frontend code injection
Related in Supply Chain
