Polymarket restricts trading amid reports of unauthorized withdrawals

Polymarket limited trading to order cancellations and suspended relayer actions amid user reports of unauthorized withdrawals. Users reported a possible compromise of the prediction market's frontend. Polymarket is investigating a security incident. The platform's status page lists a major outage affecting the trading API. Traders can cancel orders already placed, but cannot submit new orders. The suspended relayer actions send transactions signed by users to the blockchain.

A trader known as CarOnPolymarket said unauthorized withdrawals had cost the trader $800,000. CarOnPolymarket said other accounts were affected and a friend had lost around $600,000. The trader urged users to secure accounts and avoid interacting with the website.

Arkham data shows about $2.65 million in POL in the wallet 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18, identified as belonging to the suspected attacker. POL is Polygon's native token. The wallet recently received multiple conversions of USDC.e into POL through the cross-chain swapping service Relay. USDC.e is a bridged form of the USDC stablecoin. Transactions first appeared about an hour ago. The wallet recorded no activity during the last five minutes.

Hudson Rock researchers said a script served through web performance monitoring service DebugBear contains code targeting trading sessions of logged-in users. Hudson Rock said the code tries to sell users' positions and transfer the resulting assets. Hudson Rock said the script specifies the suspected attacker's wallet as a hard-coded fallback recipient. Hudson Rock also said Polymarket's production website code documents removal of the script. Hudson Rock has not determined how the compromise began or how many users were affected.

Polymarket has not identified the incident's cause. A private key compromise in May resulted in roughly $700,000 being drained from an internal top-up wallet. A third-party vendor compromise a month later enabled hackers to insert malicious frontend code and steal about $3 million from fewer than 15 accounts. Polymarket pledged full refunds following that incident.