Polymarket exploit analysis

On 29 October 2026, after assets had been moved out of user accounts by malicious code delivered through a third-party provider, Polymarket's international trading platform went into cancel-only mode, and the company paused the service that submits transactions on behalf of users. Trading was restored later the same day. Polymarket has said traders who lost money will be fully reimbursed, without publishing a timeline or a claims process (Blockonomi).

The third-party script

The code was traced to a website performance-monitoring service, the kind of script a company uses to see how its pages load and behave. According to the researchers who identified it, the malicious code accessed users' trading sessions and started actions that moved assets out of their accounts. The exact method is still under investigation (Blockonomi). DeFiLlama's account is that malicious JavaScript hijacked authenticated sessions to sell prediction-market positions and transfer assets to attacker-controlled wallets (DeFiLlama).

Bubblemaps traced the funds from hundreds of deposit wallets into a single address, 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18. Its diagram showed 712 deposit wallets and about $2.71 million moving through that main route, with the funds converted into POL, the native token of Polygon, and sent on to several addresses. Transfers to Ethereum were tracked as well. Bubblemaps estimates about $2.7 million was taken from roughly 700 users, a figure Polymarket has not confirmed (Blockonomi). The incident account puts the combined user losses at about $2.65 million (web3isgoinggreat). DeFiLlama's hacks database records the loss on 29 October at $2.7 million on Polygon, filed as a supply chain attack against frontend and infrastructure (DeFiLlama).

What Polymarket said

Polymarket reported that one of its third-party providers had been compromised, that the provider is based in the United Kingdom, and that its own website was not breached. UK law enforcement was notified. The company declined to say how many traders were affected or how much was lost. The platform that was targeted is the international one, which is banned in the United States and several other countries. Polymarket US, the newer federally regulated exchange for American users, was not affected (Blockonomi).

The June incident and one that was not a vendor problem

Polymarket's earlier loss is in this corpus too (Polymarket exploit analysis), and it has the same shape. On 25 June a third-party vendor was compromised and malicious code was injected into Polymarket's frontend, where it phished users into approving fraudulent token transfers. Polymarket said it had removed the affected dependency, contained the incident and would fully reimburse affected users. The reported size of that loss varies: crypto.news put it at an estimated $2.94 million from at least 11 user wallets, the incident account gave $2.97 million, and DeFiLlama records $3 million (crypto.news, web3isgoinggreat, DeFiLlama). The stolen funds were swapped out of Polymarket USD into ETH.

The entry point is the same in both cases. What differs is the step after it. In June the script needed a user to approve a fraudulent transfer, and the money left at least 11 wallets. In October the script worked through users' trading sessions, and the money left 712 deposit wallets.

DeFiLlama also records a third Polymarket loss this year, about $700,000 in POL drained from an internal operations wallet on 22 May by an attacker holding a six-year-old private key. Polymarket confirmed that user funds were unaffected. That one was not a vendor problem, and it sits outside the pattern the company has pointed to twice (DeFiLlama).