Polymarket reopened trading on its international platform at about 3 p.m. ET on Thursday and said it will repay every trader who lost money after one of its third-party providers was compromised.
Polymarket said in posts on X that trading was “fully back online” and that it is “fully reimbursing all affected traders.” The posts came from Polymarket Traders, a verified Polymarket account featuring its traders, and @Polymarket reposted the 3 p.m. update. Polymarket’s status page marked the incident resolved at 3:05 p.m. ET.
The exchange was in cancel-only mode by 2:05 p.m. ET, with relayer actions paused, according to the status page. At 2:33 p.m., Polymarket wrote that it had fixed “an issue impacting our international platform” at Polymarket.com, that “one of our 3rd party providers was compromised” and that it had referred the matter to law enforcement. It said trading was halted “out of an abundance of caution” and that anyone affected “will be made whole.” A 2:54 p.m. post said trading would restart around 3 p.m.
Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.
What Polymarket Hasn’t Disclosed
Polymarket has not said how much was taken, how many accounts were hit or which provider was compromised. According to Arkham figures cited in news reports, the suspected attacker’s wallet held close to $2.65 million worth of POL. Security firm Hudson Rock counted roughly $2.19 million at a fallback address in the malicious code and called that figure unverified. Another news report put the loss at around $2.6 million, based on transaction records.
Hudson Rock said a script served from DebugBear‘s servers was built to find users signed in to Polymarket, check their holdings and then try to dump or transfer them. DebugBear, a U.K.-based analytics company, was aware of an “ongoing security incident” and told customers of its RUM product to remove its embed code, according to a news report.
Separate From June’s Exploit
Thursday’s incident is separate from a front-end exploit in June, when an unnamed vendor’s compromise let attackers inject code into Polymarket’s site. Bubblemaps estimated about $3 million was drained from fewer than 15 users, and Polymarket pledged to reimburse them. In May, a compromised private key let attackers drain about $700,000 from an internal wallet used for user rewards. Separately, Unchained reported Tuesday that the CFTC is investigating, per Reuters, whether Polymarket kept U.S. users off its offshore market as a 2022 settlement required.
Why It Matters
From what Polymarket and researchers have disclosed, all three incidents since May came through access points around Polymarket’s platform (a company wallet key, a vendor and now a third-party provider) and not through a reported flaw in its trading contracts. In June and again Thursday, Polymarket pledged the same day to reimburse affected users.
Related Listen: How Did Hackers Take $388M From Bitget Without a User Withdrawal?
