Polymarket suffered a serious frontend security breach on Thursday, October 29, 2026, after a malicious script injected through a third-party vendor compromised user wallets and drained nearly $2.6 million within minutes.
Blockchain data from Arkham showed a wallet address identified as belonging to the suspected attacker held about $2.65 million in POL following multiple USDC.e-to-POL swaps through Relay. The funds were subsequently moved to different addresses.
In response, Polymarket placed its exchange in cancel-only mode, allowing users to cancel orders but preventing new orders or trades from processing. Relayer actions were paused during the investigation. The platform later stated it had found and fixed the cause, confirming that one of its third-party providers was compromised and that the matter had been referred to relevant law enforcement.
According to Coinbase director Conor Grogan, 995 accounts were drained for a total of $2,654,211.42, with the largest individual losses reaching $341,000 and $307,000. The hacker reportedly converted all stolen funds to POL, most likely to avoid freezing. Although Polymarket’s smart contracts remained untouched, the attack highlighted the fragility of frontend layers and third-party dependencies. The team isolated the vulnerability, paused relayer operations, and confirmed it will fully reimburse stolen balances to affected accounts while the forensic audit concludes.
