Polymarket Halts New Trading After Reported Wallet Drains
Polymarket restricted trading to cancel-only mode and paused relayer actions on Oct. 29 while investigating reports of drained wallets. Social media loss claims reach $2.68 million but remain unconfirmed, and accounts of the company's response conflict.
Users on Polymarket can pull their orders but cannot place new ones. On Oct. 29 the prediction market restricted its platform to cancel-only mode and paused relayer actions while it investigates reports of drained user wallets. According to the platform's status update, existing orders can be cancelled, but new orders and trades are not processing.
The incident notice records the disruption at 18:05 UTC (2:05 p.m. EDT) and classes it as a major outage affecting the Predictions Trading API, the central limit order book (CLOB) that matches trades. The notice does not identify Polymarket's separate regulated US exchange as affected.
What users are reporting
The loss figures come from social media, and none has been confirmed. A trader named Car said he lost $800,000 and that a friend lost $600,000.
"All my positions were sold"
Car, X user
He suspected a frontend compromise but offered it as a possibility, not a finding.
The account @StarPlatinum_ alleged $2.68 million in losses through hundreds of withdrawals via Polymarket's deposit-wallet infrastructure. By its timeline, funds began arriving at 17:05 UTC, reached $412,000 by 17:25 and $2.02 million by 17:50, and peaked at $2.68 million at 18:05, with activity still recorded at 18:10. The account also claimed the recipient accumulated 28.6 million POL and that Relay's sponsored transaction infrastructure was involved.
The same account said a frontend compromise has not been officially confirmed. A signing-request image shared by user Jeremy shows a "DepositWallet" data field, chain ID 137 and an "Unverified" indicator, but no completed transaction or hash.
Conflicting accounts of Polymarket's response
Reports diverge on what the company has said. Early coverage, shortly after the halt, found no official statement, cited losses in the hundreds of thousands and noted that users were being warned not to connect wallets or sign transactions. It also found no evidence so far of a core smart-contract exploit.
A later report says Polymarket blamed a compromised third-party provider, said the issue was fixed and pledged to make affected users whole, while keeping trading halted. The details of that pledge could not be verified. Polymarket's own status updates, as described in other coverage, speak of an investigation, do not confirm a frontend compromise and contain no reimbursement promise. Polymarket has not confirmed individual or aggregate losses, the recipient, or the route of funds.
Why it matters
If the incident proves to be frontend-only, the core protocol may come through intact. That distinction matters structurally: a frontend attack tricks users into signing malicious requests, much like a forged form slipped across a bank counter, while the vault behind the counter stays sealed.
The history is still uncomfortable. In June, Polymarket acknowledged that a compromised third-party vendor let a malicious script into its frontend for some users, and pledged full reimbursement. Specter estimated $2.94 million was taken from at least 11 wallets, while AMLBot later put the figure at $3.1 million. By one count this is at least the third security scare of 2026, following a May breach of an internal POL wallet.
The timing is awkward. Polymarket has been under scrutiny over market integrity, having probed dozens of midterm bets and referred at least two cases to the CFTC ahead of the Nov. 3 vote. An outage of unknown length during that run-up tests user trust in the platform's operational security as well as its surveillance.
