Polymarket has restored trading on its international platform after a security incident compromised one of its third-party service providers on October 29. The prediction market platform said it has fixed the issue, contacted law enforcement, and will fully reimburse all affected traders.
The platform initially moved to cancel-only mode, allowing customers to withdraw existing orders while halting new trades. It also paused the service that submits transactions on behalf of users before fully restoring trading functionality.
Estimated Loss Amount
Blockchain analyst Bubblemaps traced the incident and estimated that approximately $2.7 million was stolen. The analysis showed 712 deposit wallets with about $2.71 million moving through identified attacker addresses. According to Bubblemaps' findings, the stolen funds were converted into POL, Polygon's native token, and distributed across several addresses, with additional transfers tracked to Ethereum.
Polymarket has not yet independently confirmed these loss figures or provided its own total damage assessment.
Attack Method Under Investigation
Researchers examining the incident linked suspicious code to a website performance-monitoring service, which typically helps companies understand how their websites load and function. The malicious code reportedly accessed users' trading sessions and initiated actions that moved assets from their accounts. A full analysis of the attack method remains under investigation.
Pending Reimbursement Details
Polymarket has promised a full repayment to affected traders but has not yet provided a reimbursement schedule or specified requirements for filing claims. Users are awaiting further updates that will clarify which accounts qualify for compensation, how losses will be calculated, and when funds will be distributed.
