Polymarket halts trading after user funds drained in third-party breach

Polymarket suspended trading on its international platform today after an exploit drained user funds, and it referred the case to UK law enforcement after tracing the breach to one of its third-party providers. The venue, one of the main sources of Fed and GDP odds pricing alongside Kalshi, went into cancel-only mode and paused relayer actions at about 18:05 UTC, halting new buy and sell orders for roughly an hour before trading resumed at about 19:00 UTC (3:00 PM ET). The US platform was not affected.

The first public alarm came at about 17:45 UTC, when a trader on X reported that $800,000 had been drained from an account and that a friend had lost roughly $600,000, with about $1.4 million in reported losses combined. Within a few minutes the scale looked larger still. The Block, citing on-chain data, reported that more than $2.5 million had been taken in a short window. This is a material number for a venue whose settlement token, pUSD, is meant to be backed one for one by USDC, and whose noncustodial design is a central part of its pitch: platforms like this are supposed to let users hold their own assets rather than park them with a central exchange.

Related reading: CFTC prediction markets rule: event contracts would count as swaps, casino wagers excluded from definition.

Polymarket confirmed the cause openly. In a statement it said one of its third-party providers had been compromised, that it had found and fixed the issue, and that it had referred the matter to law enforcement in the UK, where that provider operates. It also pledged that anyone who has been impacted will be made whole. Security firm Hudson Rock attributed the wallet-draining code to a script hosted on DebugBear, a website-monitoring service, that hard-coded the attacker's address. Exactly which provider was breached and how the attacker got the signing material into a position to move user funds has not been fully explained, and no formal loss total or victim count has been named.

The attack was not the first against a prediction venue this week. On October 27, rival Predict.fun said it had lost $400,000 to attackers, a figure reported by Yahoo Finance and BeInCrypto. Two drain reports in three days shifts the conversation about this corner of the market. Until now most of the scrutiny on Kalshi, Polymarket and their peers has been about the validity of the markets themselves: whether political and economic event contracts settle fairly, and whether they move with real information. This week the question is simpler and more operational. Can these venues keep the money safe when the mechanism that settles their markets, a stablecoin peg running over Polygon, is only as sound as the quietest link in the supply chain?

Related reading: September CPI market: Kalshi 0.5% contract settles YES, October Fed hike odds jump to 36.5%.

It is worth being precise about who carries the loss. Because Polymarket has pledged to reimburse affected users in full, the direct financial hit lands on the platform, not on the customers whose balances were swept. That is a notable choice, and it is the right one for a venue whose reputation turns on trust in its settlement promise. But it also exposes the cost structure behind noncustodial venues. When an exchange says it will make users whole, that is not an admission arbitraged by a guarantee fund; it is a cost the platform must fund out of its own balance sheet, and it will differ from how a wallet-level breach is handled on a custodial exchange where the custodian's own book absorbs the shortfall.

The referee of all this remains the resolution record. Prediction platforms sell themselves on an honest grade: a market resolves on the certified primary source, and the betting public trusts the outcome because the mechanism is transparent. This incident does not touch that settlement logic directly. No market was repriced by the breach, and no resolution was altered. What the exploit does pressure is confidence in the plumbing around those markets: the custody layer, the settlement token and the third-party integrations that sit between a user's wallet and the order book. Confidence of that kind is rebuilt slowly and can be lost quickly.

Related reading: Kalshi AI Market Odds Reach 85%, but Filing and Live Rules Differ.

For now the dated unknowns are the ones every affected user and every tracker of venue health should look for. Polymarket has not said what caused the incident beyond the third-party compromise, has not named a formal dollar total for losses, and has not given a victim count. The next concrete updates, a forensic postmortem, a law enforcement disclosure or a direct reimbursement announcement, will do more to set the security reputation of noncustodial prediction venues than any single market move this week. The markets themselves did not lie. The question is whether the platforms holding them can be trusted to protect the funds behind every contract.

Related reading: Fed December 2026 hike odds: Polymarket prices 74.5% for a 25 bps move after jobless claims print at 194,000.

This content is for informational purposes only and does not constitute financial advice. Past performance is not indicative of future results. Consult a qualified financial advisor before making investment decisions.