Polymarket has restricted trading to cancel-only mode and paused relayer actions while investigating an incident on Oct. 29, as users have reported unauthorized withdrawals and one social media account has alleged losses of $2.68 million.
Summary
- Polymarket has restricted trading and paused relayer actions while investigating an incident.
- A trader named Car reported losing $800,000 and said all his positions were sold.
- StarPlatinum alleged $2.68 million in losses, without official confirmation of the amount or cause.
- The company’s status updates have described an investigation without confirming a frontend compromise.
Polymarket’s incident notice records the disruption at 18:05 UTC and classifies it as a major outage affecting its Predictions Trading API, known as the CLOB.
Polymarket allows cancellations while new trading stops
In a status update, the platform said users could cancel existing orders, but new orders and trades were not processing. Relayer actions remained paused during the investigation, according to the update published by Polymarket Status.
The incident notice states that the exchange is in “cancel-only mode and relayer actions paused.” Its affected-services list identifies Predictions and the Predictions Trading API, without naming a compromised vendor, describing an attack method, or providing a loss estimate.
The recorded notice time corresponds to 2:05 p.m. Eastern Daylight Time on Oct. 29.
Neither the notice nor the status posts examined announced a reimbursement program, a deadline for customers to withdraw, or a timetable for restoring normal trading.
Traders report losses and suspect a frontend compromise
Posting on X, a trader using the name Car said his account had been drained of $800,000 and claimed a friend had lost $600,000. In a reply, he wrote, “All my positions were sold,” linking to his public Polymarket profile.
In a subsequent post, Car described precautions he said he routinely takes, including separating personal activity, development, and trading across different devices. He suspected a frontend compromise because multiple users appeared to be affected, but presented that explanation as a possibility.
Jeremy, another X user, described Polymarket as being hacked and said its frontend was reportedly compromised. His post included the platform’s outage notice and an image of a wallet message-signing request displaying the Polymarket domain.
The signing image shows a data field labeled “DepositWallet,” chain ID 137, and an “Unverified” indicator. The image does not display a completed transaction, a transaction hash, or the full verifying-contract field.
A separate account, StarPlatinum, alleged that hundreds of withdrawals had passed through Polymarket’s deposit-wallet infrastructure, with a recipient wallet accumulating funds over roughly an hour.
According to that account’s timeline, the wallet began receiving funds at 17:05 UTC, held $412,000 by 17:25, reached $2.02 million at 17:50 and peaked at $2.68 million at 18:05. Suspicious activity was still being recorded at 18:10, the post claimed.
StarPlatinum identified a suspected recipient address and a Deposit Wallet Factory proxy, and alleged that Relay’s sponsored transaction infrastructure was involved. The account explicitly said suspicions of a compromised frontend had not been officially confirmed.
The same post claimed the recipient accumulated 28.6 million POL, with funds being converted from user deposit balances.
The figures remain social media estimates. Polymarket’s examined statements did not confirm the reported individual losses, the aggregate amount, the recipient’s identity, or the proposed transaction route.
June’s Polymarket attack prompted a refund pledge
In June, Polymarket acknowledged that a compromised third-party vendor had allowed a malicious script into its frontend for some users, as crypto.news previously reported in coverage of its earlier refund pledge.
The company said it had contained the incident, removed the affected dependency, and was contacting affected customers to reimburse them in full. Blockchain analyst Specter initially estimated that $2.94 million had been taken from at least 11 wallets.
A subsequent loss estimate reached $3.1 million, according to AMLBot. In its June 27 assessment, the firm described funds being taken in PUSD on Polygon, converted through Relay, bridged to Ethereum and swapped into ETH.
The earlier reimbursement commitment concerned the June incident. The Oct. 29 notices examined contained no equivalent promise concerning the newly reported losses.
Separate US venue operates under federal derivatives rules
Polymarket’s international blockchain platform and its regulated US exchange operate as distinct venues. Coverage updated July 31 describes the international service as wallet-based, while the American exchange operates through a CFTC-licensed exchange and clearing organization.
The Oct. 29 incident notice examined names the Predictions Trading API on the international service’s status site. It does not identify the separate American exchange as an affected venue.
Elsewhere in prediction markets, Predict.fun confirmed unauthorized wallet transfers totaling approximately 400,000 USDT in an Oct. 27 statement. Its preliminary investigation pointed to a possible compromise of an externally hosted API documentation site.
Predict.fun said the affected documentation site would remain offline during its investigation and promised full reimbursement for losses directly resulting from that incident. The company committed to publishing a detailed post-mortem after completing the investigation.
