Security firm Hudson Rock says the code that drained accounts arrived in a script loaded from a web performance monitoring service, with one wallet hard-coded as its recipient. Polymarket has not named the provider or confirmed a loss total.
Polymarket stopped accepting new orders on Thursday after unauthorized transfers began leaving user accounts, and later said a compromised third-party provider was the cause. The prediction market moved its exchange into cancel-only mode, which lets traders cancel existing orders but not place new ones, and paused its relayer, the service that submits users' signed transactions to the blockchain.
In a post on X, the company said it had “identified & fixed an issue impacting our international platform, Polymarket.com,” that one of its third-party providers had been compromised, and that it had referred the matter to law enforcement. “Anyone who has been impacted will be made whole,” the post said. Its status page recorded the disruption as a major outage of the predictions trading API, according to crypto.news, which logged the entry at 18:05 UTC. Polymarket has not named the provider, said how many accounts lost funds, or given a loss total.
Hudson Rock, a cybercrime intelligence firm, told Decrypt that the malicious code reached users inside a script loaded from DebugBear, a web performance monitoring service. The script searched for a visitor's logged-in trading session and then tried to sell that user's positions and move the proceeds to a wallet address written into the code as its fallback recipient, the firm said. Hudson Rock also said Polymarket's production site code records the script's removal, and that it has not established how the compromise began or how many users it reached.
If that account holds, the attack needed no flaw in Polymarket's own contracts. Code running inside the page inherits whatever a logged-in session already permits, so a trader on the real domain was exposed without having to be tricked into visiting anything. Polymarket's own framing points the same way: a supplier was compromised, not its exchange. It is the second time this year that the company has attributed losses from user accounts to a compromised outside vendor.
No loss figure is confirmed. Arkham data cited by Decrypt and The Block showed a wallet flagged as the suspected attacker's holding about $2.65 million in POL, Polygon's native token, accumulated through a series of swaps out of USDC.e using the cross-chain service Relay. That balance is what one address held at one moment rather than a tally of what users lost, and the funds were moved on afterward. One trader, posting as CarOnPolymarket, said $800,000 had been taken from his account and that a friend lost about $600,000. Both figures are self-reported.
Published figures ranged from about $2.5 million to $2.65 million on Thursday, all of them read off that wallet rather than supplied by Polymarket. The first transfers appeared roughly an hour before Decrypt published at 18:53 UTC, by which point the address had been inactive for several minutes.
Polymarket has had two earlier incidents this year. In May a private key compromise drained about $700,000 from an internal top-up wallet. About a month later a compromised outside vendor got malicious code into the frontend and roughly $3 million left fewer than 15 accounts, which the company refunded. The analytics firm AMLBot later put that total at $3.1 million and traced the funds from Polygon through Relay to Ethereum. Relay appears in Thursday's route as well, though a public cross-chain swap service is open to anyone and its presence identifies no one.
Polymarket is not the only prediction market to trace user losses to third-party web infrastructure this week. Predict.fun said on October 27 that about 400,000 USDT had moved out of accounts without authorization, and pointed to a possible compromise of an externally hosted API documentation site.
The shape is familiar from elsewhere in crypto. Ledger worked through a case across October in which it confirmed a hardware implant inside a third-party wallet device sold to customers, and Qubic halted its own chain to freeze most of a wallet drain it had no other way to stop. In each case the defect sat in something the user had no way to inspect.
What Polymarket has not said is when normal trading resumes, how it will identify the accounts it intends to reimburse, and which provider was compromised. The last of those is the detail that would let other sites running the same script check their own pages.
