Polymarket has confirmed that it fixed an issue affecting its international platform after a third-party provider was compromised. The company temporarily restricted trading and paused certain relayer activities while investigating the incident. However, traders have reported significant losses, with one account claiming that $2.68 million was taken.
According to Polymarket’s incident notice, the disruption began at 18:05 UTC and affected its Predictions Trading API, also known as the CLOB.
Polymarket fixes the issue and refers the incident to law enforcement
Polymarket said it had identified and fixed the problem, which it linked to a compromised third-party provider. The company also referred the incident to relevant law enforcement authorities.
In a later update, the platform confirmed that a fix had been deployed and was being monitored. Trading was scheduled to resume around 3 p.m. ET on October 29.
However, Polymarket did not identify the compromised provider, confirm the reported losses, or announce any plans to reimburse affected users.
Traders report major losses
A trader known as Car claimed on X that his account had lost $800,000. He also said a friend had lost another $600,000. In a reply, he stated that all his positions had been sold.
Car said he had followed strict security practices throughout his 10 years in crypto, including avoiding suspicious downloads, unknown contacts, questionable links, and unnecessary wallet connections.
He suspected that the platform’s frontend may have been compromised because multiple users appeared to be affected. However, he presented this as a possible explanation rather than a confirmed cause.
Another X user, Jeremy, also described the incident as a possible frontend compromise. His post included an image of a wallet message-signing request displaying the Polymarket domain.
The signing request showed a field labeled “DepositWallet,” chain ID 137, and an “Unverified” indicator. However, the image did not show a completed transaction or provide enough information to confirm what happened.
StarPlatinum claims losses reached $2.68 million
Another account, StarPlatinum, alleged that hundreds of withdrawals had moved through Polymarket’s deposit-wallet infrastructure, with funds collecting in a recipient wallet over roughly an hour.
According to its timeline, the wallet received funds starting at 17:05 UTC. The amount reportedly reached $412,000 by 17:25, increased to $2.02 million by 17:50, and peaked at $2.68 million around 18:05.
The account also identified a suspected recipient address and a Deposit Wallet Factory proxy, claiming that Relay’s sponsored transaction infrastructure may have been involved.
It further alleged that the recipient wallet accumulated 28.6 million POL through transfers involving users’ deposit balances.
However, these figures and explanations come from social media reports and have not been officially confirmed by Polymarket. The company has not verified the total losses, the identity of the recipient, or the exact method used to move the funds.
Polymarket previously faced a similar attack in June
This is not the first time Polymarket has dealt with a frontend security incident.
In June, the company acknowledged that a compromised third-party vendor had allowed a malicious script to affect its frontend for some users.
Polymarket said it had contained the incident, removed the affected software dependency, and contacted affected customers about full reimbursement.
Blockchain analyst Specter initially estimated that at least 11 wallets had lost around $2.94 million. A later assessment by AMLBot placed the estimated losses at approximately $3.1 million.
According to that investigation, the stolen funds were taken in PUSD on Polygon, converted through Relay, bridged to Ethereum, and exchanged for ETH.
The reimbursement commitment applied to the June incident. Polymarket’s October 29 updates did not include a similar promise for users affected by the latest incident.
The international and US Polymarket platforms are separate
Polymarket operates two distinct venues. Its international platform is a wallet-based blockchain service, while its US exchange operates under a CFTC-regulated structure.
The October 29 incident notice specifically identified the Predictions Trading API on the international platform. It did not indicate that the separate US exchange was affected.
Meanwhile, another prediction market platform, Predict.fun, also reported unauthorized wallet transfers on October 27. The company confirmed losses of approximately 400,000 USDT and said its preliminary investigation pointed to a possible compromise involving an externally hosted API documentation site.
Predict.fun said it would reimburse users for losses directly caused by the incident and publish a detailed report after completing its investigation.