Polymarket Halts Trading Over Exploit That Stole Estimated $2.7M From Users

Polymarket Affected by Third-Party Exploit

On Thursday, Oct. 29 at 2:33 p.m. ET, Polymarket wrote on X that it had identified the exploit on its website for international users and paused trading as a precaution.

“We’ve identified and fixed an issue impacting our international platform, Polymarket⁠.com. One of our third-party providers was compromised, and we have referred this to relevant law enforcement,” it wrote. “Anyone who has been impacted will be made whole.”

Trading resumed at approximately 3:00 pm ET, with Polymarket adding that “we’ll make this right and are fully reimbursing all affected traders.”

0xngmi, the pseudonymous developer behind DeFi analytics resource DeFiLlama, wrote on X that they tracked approximately $2.7 million worth of losses attributed to the exploit.

“Attacker attacked a company that does web performance tracking and whose scripts were being pulled on Polymarket, so everyone who visited polymarket got exposed,” they wrote, adding that users’ wallet seed phrases remained safe.

Polymarket previously suffered a security breach in May that resulted in approximately $700,000 in cryptocurrency being stolen after hackers compromised a six-year-old private key used for internal operations. Analytics firm Bubblemaps reported that attackers were transferring POL tokens across 16 addresses, including cryptocurrency exchanges.

Polymarket confirmed the incident but maintained that customer funds, smart contracts, and market resolution systems were unaffected. The company subsequently rotated the compromised key, revoked production permissions, and announced plans to migrate its private keys to a more secure key management system to prevent similar incidents.

Prediction-market operator Kalshi has secured another $1 billion in funding, lifting its valuation to $40 billion, nearly 82% above its…