Crypto · · 3 min read
Editor: Bohdan S.
Polymarket halts trading after third-party breach drains user wallets
Polymarket paused its international exchange for about an hour after a hacked outside provider was used to empty some accounts. It says affected users will be made whole.
The short answer
On October 29, Polymarket put its international prediction market into cancel-only mode after users reported unauthorized withdrawals. The company blamed a compromised third-party provider, said the issue was fixed, promised to make affected users whole and restarted trading at 3 p.m. ET. Total losses have not been confirmed. Its separate US exchange kept running normally.
What happened
Polymarket, a crypto-based platform where people trade on the outcome of real-world events, halted trading on its international site on Thursday afternoon. According to BNO News, users began reporting around 17:30 UTC that all their shares had been sold and their wallets emptied. The company's status page logged a major outage at 18:05 UTC, letting traders cancel orders but not place new ones, Finwire reported. Polymarket later said one of its outside providers had been compromised, that it had fixed the problem and referred the matter to law enforcement, according to CNBC. Trading resumed at 3 p.m. ET.
What it means
The key detail is where the attack allegedly came in. According to BNO News, people tracking the incident said code loaded from an outside analytics service began acting maliciously on the official website, harvesting trading credentials stored in users' browsers. One user described the script dumping every open position at falling prices before converting the balance and sending it to the attacker. Polymarket has not publicly described the method, and none of these accounts has been independently verified.
This kind of breach is different from a hack of the blockchain code itself. Polymarket's international venue runs on the Polygon network, and users hold funds in non-custodial wallets, meaning the company does not keep the money for them, Crypto Briefing explained. The website is a layer sitting on top. If attackers tamper with that layer, they can trick users or their browsers into approving transactions that look normal. So far there has been no sign that the underlying smart contracts, the on-chain programs that hold and move funds, were broken.
How much was taken is still unclear. On social media, one trader said he lost $800,000 and a friend $600,000, and another account claimed a receiving wallet gathered about $2.68 million within an hour, Finwire reported. Those are allegations, not confirmed totals. A Polymarket spokesperson told CNBC the matter had been referred to UK authorities because the affected provider operates there.
The timing and the track record both matter. Crypto Briefing counted this as at least Polymarket's third security scare in 2026, after an internal wallet breach in May and a June supply-chain attack that drained about $3 million from fewer than 15 wallets. The latest outage also came days before the US midterm elections on November 3, when CNBC said both the international and US exchanges were expected to see heavier trading.
The bull case
Polymarket moved quickly. Trading was frozen within roughly an hour of the first reports, the company said it fixed the issue the same afternoon, and it has pledged to make every affected wallet whole. Its US exchange, which is regulated separately, was untouched. If refunds are paid fast and the cause stays limited to one outside vendor, users may see this as a contained incident rather than a flaw in the platform.
The bear case
A repeat matters more than a single event. Another breach through outside website code, months after a similar June attack, raises questions about whether earlier safeguards worked. Losses are not yet confirmed, and social media claims run into the millions. A disruption just before a major election could push some traders toward rival platforms or prompt tougher scrutiny of offshore prediction markets that are not regulated in the US.
Why it matters
For investors
The direct market effect is narrow because Polymarket is privately held, but trust in crypto-based prediction markets and in Polygon-based apps could be tested. Investors in exchanges and wallet providers may watch how quickly refunds are completed.
The wider context
For anyone using crypto apps, this is a reminder that risk can come from the website and its outside code, not only from the blockchain. A company's promise to refund losses helps, but it depends on that company's willingness and ability to pay.
Market impact
| Asset (ticker) | Possible move | Timeframe | Why |
|---|---|---|---|
| Polygon (POL/USD) | ↔ Unclear | Short term | Polymarket runs on Polygon, but the breach was reportedly in website code, not the network. |
The FinPrism newsroom's view of how these figures could move, as of . It is general news commentary, not a recommendation to buy, sell or hold anything.
Frequently asked questions
Why did Polymarket halt trading on October 29?
Users of Polymarket's international platform reported unauthorized withdrawals and positions being sold without their consent. The company switched its exchange to cancel-only mode, said a third-party provider had been compromised, fixed the problem and resumed trading at 3 p.m. ET the same day.
Will Polymarket refund users who lost money in the hack?
Polymarket said anyone affected will be made whole and told CNBC it would cover affected wallets. It has not said how much was taken or how refunds will be paid. Social media posts claimed losses reaching into the millions of dollars, but those figures are unconfirmed.
Was Polymarket's US exchange affected by the breach?
No. CNBC reported that Polymarket's domestic exchange operated normally during the outage. The disruption hit its international platform, a decentralized venue built on the Polygon blockchain that is not regulated in the US and runs separately from the American exchange.
Sources: CNBC, BNO News, Finwire, Crypto Briefing
How this was made: written with AI assistance from the sources listed above, following our editorial standards.
