Polymarket · Decrypt
Polymarket Pauses Trading as Prediction Market Investigates Security Incident
Compiled by KHAO Editorial — aggregated from 4 sources. See llms.txt for citation guidance.
✓ KHAO Verified
Polymarket users are reporting that the prediction market’s frontend may be compromised, with assets being withdrawn from accounts without permission.
Key facts
- In May, a private key compromise drained roughly $700,000 from an internal top-up wallet
- Arkham data shows that a wallet identified as the suspected attacker’s, 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18, holds about $2.65 million in POL, Polygon’s native token
- Polymarket users are reporting that the prediction market’s frontend may be compromised, with assets being withdrawn from accounts without permission
- Polymarket later confirmed that one its third-party providers was compromised
Summary
Polymarket put its exchange in cancel-only mode and paused relayer actions as users report funds withdrawn without permission. A wallet flagged as the suspected attacker’s holds about $2.65 million in POL, per Arkham data, after multiple USDC.e-to-POL swaps through Relay. Hudson Rock says a DebugBear-hosted script containing wallet-draining code hard-codes that same address as its fallback recipient. The platform’s status page shows its trading API in a major outage and the exchange in cancel-only mode, meaning traders can pull existing orders but not place new ones.