Polymarket restricted its trading platform to cancel-only mode on October 29, 2026, following unconfirmed reports of drained wallets and a possibly compromised frontend. The pause also extended to relayer actions, services that submit transactions on users' behalf.
In cancel-only mode, users can withdraw existing orders but cannot place new trades. Polymarket advised users not to connect wallets or sign transactions while the situation develops.
What Occurred
Reports emerged on social media describing unauthorized withdrawals and suspicious signature prompts. Several users reported what appeared to be a frontend compromise, with estimated losses in the hundreds of thousands of dollars. These figures stem from user reports and remain unconfirmed, as Polymarket has not issued an official statement.
A frontend compromise differs from a smart-contract hack. The frontend is the website interface, while smart contracts are the on-chain code that manages fund transfers. If attackers tamper with the website, they can present users with malicious signature requests that appear legitimate. So far, no evidence points to a core smart-contract exploit in this incident.
The freeze on relayer actions cuts off a potential avenue for attackers to execute transactions at scale on users' behalf.
How Polymarket Operates
Polymarket runs on the Polygon network, where traders use non-custodial, Polygon-based proxy wallets. The platform does not hold user funds directly. Trading and settlement occur through pUSD, a token backed 1:1 by USDC.
Because Polygon transactions are public, any fund movements related to the reported drains can potentially be traced in real time.
Pattern of Security Incidents
This marks at least the third security incident for Polymarket in 2026. In May 2026, an internal POL wallet was breached, with estimated losses between $573,200 and $700,000. In June 2026, a supply-chain attack involving a compromised third-party script drained approximately $3 million in pUSD from fewer than 15 user wallets.
Following those incidents, Polymarket implemented geographic restrictions and enhanced monitoring of third-party scripts. The latest reports will raise questions about whether these safeguards proved sufficient.
What Comes Next
Users holding positions on Polymarket have been instructed not to connect wallets or sign transactions pending official clarification. The platform has not yet issued a formal statement, leaving users to piece together information from social media reports.
Key factors to watch include an official statement from Polymarket, confirmation of actual losses, any traced fund flows on Polygon, and details on when full trading resumes.
