Polymarket moved its exchange into cancel-only mode and paused relayer actions after a security incident that drained more than $2.6 million in minutes, according to the platform and blockchain analytics firm Arkham. The shutdown prevented users from placing new orders or executing normal exchange activity while Polymarket investigated the exploit and deployed a fix.
Arkham identified a wallet believed to be connected to the attack holding roughly $2.65 million in POL on Thursday. The wallet had carried out a series of recent swaps from USDC.e, a bridged version of USD Coin, into POL through Relay, the data platform said. Funds associated with the address were subsequently transferred across several other wallets, a common step that can make tracing and recovery more difficult.
Polymarket said in an update on X that it had identified the cause of the incident, fixed the vulnerability and referred the matter to law enforcement. The company attributed the breach to the compromise of an unnamed third-party provider rather than an issue with its core exchange infrastructure.
a compromised web component targeted active sessions
Cybersecurity firm Hudson Rock said its investigation pointed to DebugBear, an external software provider, as the source of a malicious script that had been introduced into Polymarket's website. According to Hudson Rock, the script targeted active user sessions and operated in the browser, where it could act on behalf of accounts that were already logged in.
The alleged attack path focused on open positions rather than directly breaking the smart contracts that settle trades and hold assets. Hudson Rock said the script searched for logged-in accounts with open positions, sold those positions and directed the resulting assets to a fallback wallet controlled by the attacker.
That distinction shapes the response required from Polymarket and its users. A vulnerability in a front-end website or third-party web tool can expose authenticated sessions even where the underlying blockchain contracts continue to function as designed. In this case, pausing relayer activity and putting the exchange into cancel-only mode limited the attacker's ability to submit additional malicious actions through the affected interface.
Relayers are services that help transmit signed user instructions to a blockchain or exchange system. If an attacker gains access to an active session, a relayer can become a route for pushing transactions or order changes without the account holder consciously initiating each action.
wallet activity points to rapid conversion and transfers
Arkham's on-chain data showed the suspected attacker converting USDC.e into POL shortly after the incident. The subsequent movement of funds to multiple addresses does not establish where the assets will ultimately go, but it creates a public trail for researchers, exchanges and law enforcement to monitor.
The reported loss of more than $2.6 million places the breach among the more damaging examples of a front-end compromise in decentralized finance and prediction-market infrastructure. These attacks can unfold quickly because active sessions remove the need for a criminal to obtain a user's seed phrase or persuade them to approve a new transaction in real time.
Public claims from affected account holders indicate that losses may have been highly concentrated. One user said they lost $800,000, while another profile claimed losses approaching $2.68 million. Those individual reports have not been independently verified in the material provided, but they illustrate how accounts with large open positions can face outsized exposure when session controls fail.
Polymarket has said it intends to refund stolen assets, though it has not provided a timetable for repayments or described how it will calculate claims. The company's investigation and the eventual reimbursement process will likely determine whether losses were confined to a limited set of accounts or spread across a wider group of users.
users face a difficult security check after the pause
The incident has prompted calls for Polymarket users to review wallet permissions and account access. Revoking unnecessary token approvals can reduce the scope of authority previously granted to decentralized applications, although approvals alone may not address every form of browser-session compromise.
Users should also treat fresh signature requests with caution until Polymarket confirms that its web interface and third-party integrations are fully secure. A signature can authorize actions without always producing an obvious on-chain transaction at the time it is requested, making clear prompts and trusted interfaces particularly important after a website compromise.
Changing passwords, ending active sessions where possible and reviewing connected wallet applications are also practical steps for users who accessed Polymarket during the affected period. Anyone who notices unexpected trades or transfers should preserve transaction hashes, screenshots and account records for any claims process or law-enforcement inquiry.
The breach places renewed scrutiny on third-party scripts embedded in cryptocurrency websites. Analytics tools, performance-monitoring services and other external components are widely used across the web, but each integration can add a route through which malicious code reaches users. For platforms handling tradable positions and wallet-linked accounts, those dependencies can carry consequences comparable to weaknesses in the platform's own software.
Polymarket's immediate freeze appears to have stopped further activity through the exchange while the company worked on the issue. The remaining questions center on the attacker's ability to move the funds, the scope of affected accounts and whether Polymarket's promised reimbursements will cover all verified losses.
Concerned about hacks like Polymarket’s? Learn key protection steps in this crypto security breach guide to safeguard your funds.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
