Polymarket has restricted trading and suspended relayer activity after users reported that funds were withdrawn from their accounts without permission, as the prediction-market platform investigates a suspected frontend compromise.
The exchange was placed in cancel-only mode, allowing users to withdraw existing orders but preventing them from submitting new ones. Its trading API was listed as suffering a major outage, while relayer actions were paused. Relayers submit users’ signed transactions to the blockchain, so suspending them limits further transaction activity while the investigation continues.
Polymarket later said that one of its third-party providers had been compromised. In a statement posted on X, the company said it had referred the matter to relevant law-enforcement agencies and that affected users would be made whole. The platform did not disclose how many accounts were affected or provide a detailed explanation of how the incident began.
Suspected wallet and transaction activity
According to Decrypt, blockchain data from Arkham identified a wallet suspected of belonging to the attacker. The address, 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18, held about $2.65 million in POL, Polygon’s native token, when the data was reported.
The wallet received several recent swaps from USDC.e into POL through Relay, a service used for cross-chain swaps. USDC.e is a bridged version of the USDC stablecoin. The first reported transactions began about an hour earlier, while the wallet had shown no activity during the previous five minutes.
The movements do not by themselves establish the full scope of the incident, but they provide an on-chain trail linked to the suspected attacker’s address.
Researchers point to third-party script
Cybersecurity researchers at Hudson Rock said a script hosted through DebugBear, a web-performance monitoring service, contained code capable of searching for a logged-in user’s trading session. The researchers said the code appeared designed to sell users’ positions and transfer the resulting assets.
Hudson Rock also said the suspected wallet address was hard-coded in the script as a fallback recipient. The firm reported that Polymarket’s production-site code recorded removal of the script, but said it had not determined how the compromise began or how many users were affected.
A third-party provider compromise can expose users through website code even when the core trading platform itself has not been shown to be breached. In this case, Polymarket’s decision to restrict new orders and pause relayer actions limits activity while the company examines the reported withdrawals.
Recent security incidents and market data
The latest event follows two incidents mentioned in the report. In May, a private-key compromise drained roughly $700,000 from an internal top-up wallet. The following month, hackers used a compromised third-party vendor to inject malicious code into the frontend and steal about $3 million from fewer than 15 accounts. Polymarket said those users would be fully refunded.
Moneyiar market data recorded POL at $0.0898082186 as of October 25, 2026, at 22:39 +03:30. The token was up 0.39% over 24 hours but down 0.74% over seven days. That market snapshot predates the reported Polymarket incident and should not be read as a price response to it.
