About $2.65 million ended up in a wallet flagged as the attacker's, in minutes, while Polymarket users watched funds leave their accounts without their say. Trading is now frozen, and the site says it will pay back everyone hit — but that money has not come back yet.
Key points:
- Trading is frozen: you can cancel old orders, but you cannot place new ones, and the relayer that sends your trades to the chain is paused too.
- About $2.65 million in POL sits in a wallet Arkham flags as the attacker's, after a run of swaps out of USDC.e through Relay.
- Polymarket says one of its outside providers was hit, the hole is fixed, and anyone hurt will be made whole — though it has not said how many accounts were hit.
On Thursday, Polymarket's own status page showed its trading API in a major outage and the exchange in cancel-only mode. One trader wrote on X that he had just been drained of $800,000, and that a friend had lost around $600,000. His warning was blunt: lock down your account, and do not touch the site.
Researchers at Hudson Rock say a script loaded from DebugBear, a web performance monitoring service, held code that looked for a logged-in user's trading session and tried to sell their positions and move the assets out. The same wallet address was hard-coded in that script as its fallback recipient. Hudson Rock says it has not worked out how the break-in started, or how many users were hit, and Polymarket has not said either.
Read also: Utah Files 14 Criminal Charges Against Kalshi and Its Founders
What does "made whole" actually mean here?
Polymarket later said it had found the cause and fixed it, that one of its third-party providers was compromised, and that it had passed the case to law enforcement. Its promise to hit users was short: anyone who has been impacted will be made whole. It gave no count of hit accounts, no timeline, and no detail on how refunds will work.
This is not the first time the site has made that promise. In May, a private key break-in drained roughly $700,000 from an internal top-up wallet. A month later, a compromised outside vendor let hackers slip bad code into the site and steal about $3 million from fewer than 15 accounts, and Polymarket promised full refunds then too.
My own read is blunt: a post that says "you will be made whole" is easy to write, and hard to prove until the money is back in people's wallets. Until Polymarket names how many accounts were hit and shows the refunds going out, traders have good reason to stay wary.
For now, the safe move is simple: do not log in and trade until Polymarket says trading is open again, and follow its own updates, not rumors on social media.
Read also: Ledger Tampered Wallets Cost Singapore Users $2.7M — Police Issue Warning
— BitByLine News Desk
Before you close this tab, one plain note: this story is news only, not financial advice. BitByLine never tells you to buy or sell anything, so that choice is yours alone, and the risk is yours too. Always do your own research first.
Read our full Disclaimer.
Sources: Decrypt, The Block