Polymarket halts trading after a third-party breach drains user accounts

Polymarket, the largest crypto prediction market, briefly stopped trading on Thursday after users reported money leaving their accounts. The platform blamed a breach at one of its outside service providers.

What happened

Users began reporting that their accounts were being drained. Polymarket then restricted trading, paused relayer actions and placed its exchange in cancel-only mode, meaning users could withdraw open orders but not place new ones.

More than $2.5 million was lost within minutes. Blockchain analytics platform Arkham showed a suspected attacker wallet holding about $2.65 million in POL, the token of the Polygon network on which Polymarket runs. The platform said one of its third-party providers had been compromised, and it has since resumed trading.

Background

Prediction markets let users buy shares in the outcome of real-world events, such as elections or economic data releases. Polymarket settles trades on a blockchain, but like most crypto apps it relies on outside services for parts of its operation, including relayers that submit transactions on users’ behalf.

Those links are a common weak point. An attacker who compromises a provider can sometimes act on users’ accounts without breaking the core smart contracts at all.

Why it matters

The losses are small next to the Binance hack, which struck the same day, but the incident lands at a sensitive moment for prediction markets as they seek wider acceptance from users and regulators.

The open questions are which provider was breached, how the attacker gained the ability to move funds, and whether Polymarket will reimburse affected users.