Polymarket pauses trading after $2.65M third-party compromise drains user accounts

Polymarket placed its order book in cancel-only mode and paused relayer actions on October 29, 2026 after an unnamed third-party provider was compromised and user accounts were drained. On-chain intelligence firm Arkham labels a single attacker wallet, 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18, as holding approximately $2.65M in POL after it received a stream of USDC.e → POL swaps routed through Relay. Polymarket said in a public statement that it has "identified & fixed an issue" affecting polymarket.com and has referred the matter to law enforcement.

What happened

Polymarket trader "Car" first raised the alert around 18:45 Paris time (16:45 UTC), reporting that positions on his account had been sold without his authorization and that funds were leaving the wallet. Within minutes, more users reported the same pattern. Polymarket then:

• Put the central limit order book into cancel-only mode: users could cancel open orders, but no new buys or sells could execute.
• Paused relayer actions, the server-side signing component that pushes user-authorized transactions on-chain.
• Flagged a major outage on the trading API on its status page.

By early evening US time, Polymarket said it had found the cause and that the exchange was back online. From its public post: "One of our third party providers was compromised, and we have referred this to relevant law enforcement. Anyone who has been impacted will be made whole."

On-chain trail

The suspected attacker's address, per Arkham, shows a consistent pattern over a short window: inbound USDC.e (the bridged USD Coin that Polymarket positions settle in on Polygon), swapped to POL (the Polygon-chain native token) through Relay, a cross-chain intent/relayer service. The attacker-wallet balance tracked by Arkham sits at about $2.65M in POL at the time of writing. The Block reports the figure as "over $2.5 million" to "over $2.6 million" across its coverage window; the attacker's funds have since been moved to additional addresses.

Polymarket has not published the compromised vendor's name. Hudson Rock, cited by Decrypt, said a script loaded by the Polymarket web app from DebugBear — a third-party web-performance monitoring service — contained wallet-draining code that targeted a logged-in user's trading session to sell open positions and transfer assets. DebugBear's involvement is Hudson Rock's attribution, not Polymarket's confirmation.

Mechanism — third-party frontend script, not the smart contracts

The pattern matches a browser-side session hijack rather than a smart-contract exploit:

• The malicious code appears to have run on the Polymarket web client, inside a user's authenticated session, with the keys and signing permissions the user had already granted the site.
• Rather than exploiting the exchange's on-chain contracts, it ordered sells on open positions and initiated withdrawals that looked legitimate to Polymarket's relayer.
• Funds were then routed off the Polygon USDC.e balance into POL via Relay to obscure the trail.

Impact

• ~$2.65M aggregated at the Arkham-tagged attacker address, per on-chain data.
• Confirmed trader losses so far: a single named account reports $800K, with at least one additional affected account reporting $600K, per the first French-language coverage of the incident (Cryptoast). Polymarket has not disclosed a victim count.
• The order book was down from mid-afternoon UTC until Polymarket said it was back online in the evening.
• Reimbursements are promised. Polymarket has not published terms or a disbursement timeline.

What to watch

1. Whether Polymarket confirms or disputes the DebugBear attribution. The vendor's own disclosure of what was injected and when would set the scope.
2. The victim count and total user loss once Polymarket releases numbers — the $2.65M Arkham figure tracks one attacker wallet, not aggregate drain.
3. Reimbursement mechanics and dates: pro-rata, full, by on-chain proof, or by account snapshot.
4. Movements from 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18 and any downstream addresses — the funds are now in POL and partly re-dispersed.

Context — second supply-chain incident at Polymarket in 2026

This is the second third-party-driven drain at Polymarket inside 2026. On June 25, a poisoned JavaScript dependency on the web frontend drained ~$3.1M in PUSD from at least 11 wallets before Polymarket pulled the vendor and refunded users. The present incident differs in surface (an unnamed provider versus a named dependency) but shares the pattern: Polymarket's contracts untouched; a third-party asset loaded by the website pushed malicious code into live user sessions. Supply-chain compromise through monitoring scripts, analytics tags, and perf-measurement SDKs is a repeat failure mode in crypto frontends — the hostnames that load them are rarely in CSP policies and the scripts rarely sign their payloads.

Sources

• The Block, Polymarket exploit, cancel-only mode.
• Decrypt, Polymarket pauses trading as prediction market investigates security incident.
• Arkham address page: 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18.