Polymarket has restricted trading and paused relayer actions following reports of unauthorized fund withdrawals from user accounts. The prediction market platform confirmed that one of its third-party providers was compromised, leading to a major outage of its trading API and the implementation of cancel-only mode.
Researchers identified a malicious script hosted on DebugBear that targeted logged-in users to sell positions and transfer assets. A suspected attacker wallet associated with the incident currently holds approximately $2.65 million in POL tokens after converting USDC.e through a cross-chain swapping service.
Key facts
- Polymarket placed its exchange in cancel-only mode and paused relayer actions due to the security incident.
- A wallet flagged as the suspected attacker’s holds about $2.65 million in POL, according to Arkham data.
- Hudson Rock researchers found a DebugBear-hosted script containing wallet-draining code that hard-codes the attacker’s address.
- Polymarket stated it has referred the matter to relevant law enforcement and promised to make impacted users whole.
- The incident is linked to a compromised third-party provider rather than a direct breach of Polymarket’s core infrastructure.
Why it matters
The platform explicitly committed to refunding any users who were impacted by the unauthorized withdrawals, ensuring financial restitution for those affected by the compromised third-party provider.