Polymarket Halts Trading Over Reports of Drained Wallets
Polymarket reported a major outage affecting its trading API on Thursday and moved the exchange to cancel-only mode while it investigated an incident, according to Reuters. Its status page logged the outage at 6:05 p.m. UTC and said relayer actions were paused. Traders can pull existing orders but cannot place new ones.
Per Reuters, the halt followed user reports that something more serious was underway. About 20 minutes earlier, users in Polymarket's Discord said the website may have been compromised and that assets were being withdrawn from their accounts without approval, according to a post by Aggr News cited by FairGambling. Users were warned not to connect wallets or sign transactions. As of publication, Polymarket has not confirmed a breach, said whether any funds were lost, or published a count of affected wallets. The drain reports remain unverified.
The relayer is the part of the system that matters here. It is the Polymarket service that takes transactions a user has signed, including approvals and transfers, and submits them to the blockchain on the user's behalf. Pausing it stops those requests from going through Polymarket. The status page continued to list the web app, account login and on-chain settlement as operational, which is consistent with a problem at the website or service layer rather than in the underlying contracts. No evidence of a smart contract exploit has been reported.
If the reports are confirmed, this would be Polymarket's second website attack in four months. On June 25, the company said a third-party vendor had been hacked and malicious code had been inserted into its site for some users. Blockchain tracing firm AMLBot later reported that about $3.1 million in pUSD, Polymarket's dollar token, was stolen across roughly 11 wallets and converted to ETH. Polymarket removed the code and refunded affected users in full. Separately, Gizmodo has reported on a bug that allowed identity thieves into existing accounts, and users have complained of attacks on wallets created through email and Google sign-in. Outage trackers also logged earlier disruptions in July and September.
The timing adds pressure. Polymarket begins moving new markets to rebuilt smart contracts on November 2. It is seeking a valuation reported at $20 billion, operates a CFTC-licensed US entity, and counts Intercontinental Exchange as an investor. It is also facing a lawsuit from New York over its sports contracts. Each of those depends on users and regulators trusting that money held on the platform is safe.
The pattern across both incidents is the same, and it has little to do with cryptography. The contracts held. What failed, or is suspected to have failed, was the website and the vendors behind it, the layer through which every user reaches their funds. When users approve transactions through a single interface and a single relayer, a compromise of that interface reaches everyone using it at once. A June refund made affected users whole, but it depended on the company's willingness and ability to pay. It was not a property of how the funds were held.
That is the broader lesson for anyone holding assets on a platform, whether a prediction market, an exchange or a bank app. The security of the funds is only as strong as the weakest system between the user and the asset, and most users have no visibility into which vendors sit in that chain. Assets held under keys the user controls, with signing authority spread across independent parties, do not share a single point of failure with a website.
What to watch is whether Polymarket confirms a compromise, how many wallets were affected and for how much, whether it again commits to full refunds, and whether the November 2 contract migration proceeds on schedule.