On Thursday, Oct. 29, prediction‑market platform Polymarket announced a temporary shutdown of its international trading site after detecting an exploit that allowed unauthorized withdrawals of its native POL token. The breach, traced to a compromised third‑party provider, prompted the exchange to enter cancel‑only mode, pause relayer services, and issue a public statement that law enforcement had been notified and that all impacted users would be made whole.

Technical details of the exploit

Security researchers at Hudson Rock identified a script hosted by DebugBear, a web‑performance monitoring service, as the vector for the attack. The script searched for logged‑in Polymarket sessions, read users’ holdings, and attempted to sell or transfer them to a hard‑coded fallback address (0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18). Arkham data shows that the address accumulated roughly $2.65 million worth of POL after a series of USDC.e‑to‑POL swaps executed through the Relay cross‑chain service. Hudson Rock estimated the value at about $2.19 million, noting the figure is unverified, while analysts cited by Bitcoin.com and Unchained placed the loss near $2.7 million.

The malicious code was embedded in Polymarket’s production site via the compromised provider’s embed. Once removed, the site’s code recorded the script’s deletion, but investigators have not yet determined how the initial compromise occurred or how many accounts were targeted.

Polymarket’s response and remediation

Polymarket’s status page indicated that the exchange entered cancel‑only mode at 2:05 p.m. ET, preventing new orders while allowing users to cancel existing ones. Relayer actions, which submit signed transactions on behalf of users, were also halted. By 2:33 p.m. ET the platform posted that it had “identified and fixed an issue impacting our international platform” and that a third‑party provider had been compromised.

Trading resumed at approximately 3:00 p.m. ET, with the status page marking the incident resolved at 3:05 p.m. ET. Polymarket reiterated on X that it would fully reimburse all traders who suffered losses. The company also rotated the compromised internal key, revoked production permissions, and announced plans to migrate private keys to a more secure key‑management system.

Context and regulatory backdrop

The October incident follows two prior security events at Polymarket this year: a May private‑key compromise that drained about $700,000, and a June front‑end exploit that stole roughly $3 million from fewer than 15 accounts. In each case, the breaches originated from external access points rather than vulnerabilities in Polymarket’s smart‑contract code.

Separately, Unchained reported that the U.S. Commodity Futures Trading Commission is investigating whether Polymarket kept U.S. users off its offshore market in compliance with a 2022 settlement. While the investigation is unrelated to the October exploit, it underscores heightened regulatory scrutiny of prediction‑market platforms.

What to watch next

Observers will monitor Polymarket’s reimbursement process to confirm that all affected users receive full compensation. Additional scrutiny is likely on the third‑party provider and DebugBear’s security practices, as well as any further disclosures about how the malicious script was injected. Finally, regulators may examine whether repeated supply‑chain attacks constitute a material risk that warrants tighter oversight of DeFi platforms.

Sources

This article was prepared by the CoinMag newsroom from the reports listed above.