Polymarket Pauses Trading After Third-Party Provider Compromise
Polymarket moved to cancel-only mode and paused relayer actions after users reported unauthorized withdrawals. A suspected attacker wallet holds about $2.65 million in POL, and the platform has referred the case to law enforcement.
What happened
Polymarket restricted trading and paused relayer actions on Oct 29, 2026, as users reported funds leaving their accounts without permission. The platform’s public status page shows its trading API in a major outage and the exchange in cancel-only mode, meaning traders can pull existing orders but not place new ones. Relayer actions, which submit users’ signed transactions to the blockchain, are also paused.
On-chain tracking cited by Decrypt identifies a suspected attacker wallet holding about $2.65 million in POL, according to Arkham data. The movement followed multiple USDC.e-to-POL swaps through Relay. Hudson Rock says a DebugBear-hosted script containing wallet-draining code hard-codes that same address as its fallback recipient.
Polymarket later confirmed that a third-party provider was compromised.
“We have referred this to relevant law enforcement,” the company said on X.
Key facts
- Polymarket placed its exchange in cancel-only mode and paused relayer actions on Oct 29, 2026.
- Users reported assets being withdrawn from accounts without permission; the trading API is listed as a major outage.
- A suspected attacker wallet holds about $2.65 million in POL, per Arkham data, after multiple USDC.e-to-POL swaps through Relay.
- Hudson Rock says a DebugBear-hosted script contained wallet-draining code and hard-coded the same address as its fallback recipient.
- Polymarket confirmed a third-party provider was compromised and said it had referred the matter to law enforcement.
Our analysis
The most important shift is not a market move but a trust and custody perimeter problem. Unlike a routine odds or liquidity issue, this incident touches the path users take to sign and relay transactions. When relayer actions are paused but cancel-only trading remains, that likely means Polymarket wanted to stop new signed instructions from reaching the blockchain while still letting users remove existing exposure. The reported DebugBear-hosted script adds a supply-chain angle: a third-party tool may have been altered to send funds to an address the attacker controlled.
For prediction market operators and crypto-adjacent communities, this changes the risk model. A platform may have sound market mechanics and still expose users through frontend or vendor scripts. The fact that Polymarket quickly moved to cancel-only mode and named a third-party provider suggests the response is about isolating the transaction path rather than the underlying market contracts. That is operationally significant: user funds may be at risk even if trade prices and order books are not.
The Arkham data points to a concrete recipient address, which gives moderators a practical way to track and warn about known addresses. However, the source does not confirm total losses or a root cause. Operators should avoid repeating unconfirmed totals and instead point users to official status pages and law-enforcement referrals.
What it means for operators
- Monitor Polymarket’s status page and X account before posting community updates or advising users. If you manage a crypto or prediction market community, do not amplify third-party “drainer” addresses unless they match the official report or Arkham flag.
- Treat frontend scripts and relayer integrations as part of your security perimeter. Review hosted third-party code, check for hard-coded recipient addresses, and ask whether your tooling can pause relayer actions in a cancel-only state.
- Prepare a simple incident response message for your own product or client communities: what is paused, what users should not do, and which official channel will confirm the all-clear. Polymarket’s law-enforcement referral shows the kind of update that can calm a panic without adding speculative details.
- Separate platform security events from market volatility when writing social content. Actionable guidance should focus on wallet hygiene, stopping new signs, and watching official confirmations—not on price predictions.
Source:Polymarket Pauses Trading as Prediction Market Investigates Security Incident — Decrypt(2026-10-29)
Editor's note: prepared by the NoobClaw newsroom with AI assistance from the public report above. Facts are as reported by the source; the analysis is our view. Spotted an error? Contact us and we will correct it.
This article is news and operational analysis only, not investment advice.