Key Points
- Trading operations resumed on Polymarket’s global platform following an October 29 security compromise at an external vendor.
- According to Bubblemaps analysis, approximately $2.7 million was drained from around 700 user accounts, though Polymarket hasn’t verified these numbers.
- Security experts traced the intrusion to compromised code within a website performance-monitoring tool.
- The company’s U.S.-regulated exchange remained unaffected by the incident.
- While Polymarket committed to complete reimbursement, no repayment schedule or claim procedures have been announced.
Polymarket has brought its global trading platform back online following a security compromise at a third-party service provider that occurred on October 29. The prediction market operator has committed to making affected traders whole.
Blockchain intelligence provider Bubblemaps put the losses at roughly $2.7 million. The company itself has declined to verify this estimate.
Timeline of the Platform Shutdown
Polymarket initially shifted its exchange into a cancel-only operating mode. This configuration allowed users to remove pending orders but prevented the submission of new positions.
The platform simultaneously disabled its transaction relay service, which processes blockchain submissions on users’ behalf. Subsequently, the company disclosed that a security incident had occurred at one of its external service partners.
Operations remained suspended for multiple hours during the investigation. The Polymarket Traders X account later announced that full trading capabilities had been reinstated.
According to the company’s statement, the compromised vendor operates from the United Kingdom. Polymarket emphasized that its primary website infrastructure was never penetrated and that British authorities have been informed.
Polymarket US remained operational throughout the incident. This separate platform functions as a regulated exchange for American participants under federal oversight.
The main international platform runs on cryptocurrency infrastructure. Access is prohibited for users in the United States and certain other jurisdictions.
Following the Money Trail
Bubblemaps mapped the flow of assets from numerous deposit addresses into a single wallet it attributed to the perpetrator. The analysis revealed 712 compromised deposit wallets and approximately $2.71 million flowing through the primary channel.
According to the analytics firm, the stolen cryptocurrency was exchanged for POL, Polygon’s native asset, before being dispersed across multiple destinations. Additional transfers to the Ethereum network were also documented.
Security researchers identified malicious instructions embedded within a website performance-monitoring platform. Such services typically enable organizations to analyze page load times and user experience metrics.
The researchers’ findings suggest the malicious code intercepted active user sessions and initiated unauthorized transactions that siphoned funds from accounts. Investigation into the precise exploitation technique continues.
Multiple high-profile traders acknowledged losses on X. When contacted by WIRED, Polymarket refused to disclose the total number of impacted users or confirm the financial scope.
This marks the second significant security event for the platform. A previous June 2026 incident resulted in losses exceeding $2 million for affected participants.
Since launching in 2020, the platform has weathered multiple controversies, including allegations of insider trading that culminated in arrests. Those charged have entered not-guilty pleas.
Last August 2026, Polymarket secured $1 billion in venture funding through a round spearheaded by 1789 Capital, where Donald Trump Jr. serves as a partner. The financing valued the company at $21 billion.
While Polymarket has guaranteed full compensation, no repayment timeline or claims submission process has been released. Users await clarification on eligibility criteria, loss calculation methodology, and distribution schedules. The company has indicated a comprehensive incident report will be published.


