Polymarket Pauses Trading After Third-Party Provider Hack

On October 29, Polymarket put its exchange into cancel-only mode and paused its relayer after users reported funds leaving their accounts without permission. The company said a third-party provider had been compromised and promised to cover the losses.

The story is worth a read for anyone who keeps money on a web3 platform. A wallet can stay intact while funds vanish because of someone else's script on the site.

What exactly happened?

Users began posting that money was leaving their accounts without consent. The status page showed a major outage of the trading API. The exchange only allowed cancellations: existing orders could be pulled, new ones could not be placed. The relayer, the service that passes users' signed transactions to the blockchain, was stopped too.

Polymarket later confirmed on X that one of its third-party providers was compromised. It referred the case to law enforcement and promised full reimbursement to anyone affected. The company did not name the cause.

How does this kind of attack work?

Websites rarely consist of their own code alone. Pages usually pull in outside scripts for analytics, support chats and speed monitoring. In the browser, such a script has the same rights as the platform's own code, so swapping a single file opens access to everything the page can see.

Researchers at Hudson Rock said a script from DebugBear, a service that measures website performance, contained malicious code. Here is what it did:

• Looked for a session: checked whether the browser held an active trading session of a logged-in user.
• Tried to sell the open positions.
• Transferred the proceeds to the attacker's address.
• Carried a backup recipient: the same address, hard-coded into the script.

Where did the money go?

According to Arkham data, the wallet flagged as the attacker's holds about $2.65 million in POL, Polygon's native token. It made several swaps of USDC.e, the bridged version of USDC, into POL through the Relay service. The first transactions appeared about an hour before Decrypt published its report, and within minutes the wallet went quiet.

Hudson Rock also said Polymarket's production code still records the removal of that script. How the compromise began and how many users it touched, the firm has not established.

Is this the first time for Polymarket?

No. In May, a private key leak drained roughly $700,000 from an internal top-up wallet. A month later, a compromised third-party vendor let hackers inject malicious code into the frontend, and about $3 million left fewer than 15 accounts. Polymarket promised full refunds then as well.

That makes three incidents in half a year, and in two of them a contractor was the weak spot.

What should users of such platforms do?

Nobody is immune to a hijacked third-party script, but losses can be capped. Keep on a trading platform only the amount you need for bets. Main holdings are better stored separately, in your own wallet such as MetaMask or in a hardware wallet.

Polymarket promises compensation, yet the number of victims and the size of the losses are still unknown. The investigation will show whether the problem really sits with a single provider.