Polymarket suspended trading today after a third-party provider breach allowed an attacker to drain approximately $2.65 million from user accounts. The prediction market platform placed its exchange in cancel-only mode within minutes of users reporting unauthorized fund withdrawals.
According to Arkham data, a suspected attacker wallet now holds about $2.65 million in POL tokens. Over $2.5 million was lost within minutes of the incident, according to The Block. Polymarket attributed the breach to a compromised third-party provider rather than a vulnerability in its own infrastructure, though the platform hasn’t named the provider or detailed how the compromise enabled account access.
Cancel-Only Mode and Relayer Suspension
The platform restricted trading and paused relayer actions as the breach unfolded. Cancel-only mode allows users to close existing positions but prevents new trades, a standard defensive posture when an exchange suspects ongoing unauthorized access. Polymarket hasn’t specified when normal trading will resume or whether the attacker retained access after the initial drain.
Third-party breaches have become a recurring pattern in crypto infrastructure. The attack vector typically involves compromised API keys, credential phishing, or vulnerabilities in middleware that sits between users and the core protocol. If the provider handled authentication, transaction signing, or wallet management, a breach there could grant an attacker direct access to user funds without touching Polymarket’s own systems.
Prediction Markets Under Pressure
The timing is awkward for Polymarket, which has spent the past year building institutional credibility around election and political event forecasting. The platform’s user base skews toward traders who move serious capital on macro events; a $2.65 million loss in minutes suggests the attacker targeted high-value accounts rather than spraying across the entire user base.
Polymarket hasn’t disclosed how many accounts were affected or whether it will make users whole. The platform’s terms of service and custody model will determine liability. If users held funds in Polymarket-managed wallets, the platform may face pressure to cover losses. If the breach occurred at a custodian or wallet provider Polymarket directed users toward, liability becomes murkier.
The suspected attacker wallet remains visible on-chain, holding POL tokens. Whether law enforcement or on-chain forensics can force recovery depends on how quickly the attacker moves funds through mixers or cross-chain bridges. Polymarket hasn’t indicated whether it’s working with authorities or blockchain analytics firms to trace the flow.
