Polymarket Limits Trading After Reports of Unauthorized Withdrawals

Polymarket has restricted trading to order cancellations and suspended relayer actions after users reported unauthorized withdrawals and a possible compromise of the prediction market frontend. The platform said it is investigating a security incident, while its status page lists a major outage affecting the trading API. Traders can cancel existing orders but cannot submit new ones. Relayer actions are the mechanism that sends user-signed transactions to the blockchain. A trader known as CarOnPolymarket said unauthorized withdrawals cost the trader $800,000. The trader said other accounts were affected and that a friend lost about $600,000, and urged users to secure their accounts and avoid interacting with the website. Arkham data shows about $2.65 million in POL in wallet 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18, identified as belonging to the suspected attacker. POL is the native token of Polygon. The wallet recently received multiple conversions of USDC.e into POL through the cross-chain swapping service Relay. USDC.e is a bridged form of the USDC stablecoin. The transactions first appeared about an hour ago. The wallet recorded no activity in the last five minutes. Hudson Rock researchers said a script served through the web performance monitoring service DebugBear contains code targeting the trading sessions of logged-in users. Hudson Rock said the code attempts to sell user positions and transfer the resulting assets. The script specifies the suspected attacker wallet as a hardcoded fallback recipient, according to Hudson Rock, which also said Polymarket production website code documents removal of the script. Hudson Rock has not determined how the compromise began or how many users were affected. Polymarket has not identified the cause of the incident. A private key compromise in May drained roughly $700,000 from an internal top-up wallet. A third-party vendor compromise a month later allowed hackers to insert malicious frontend code and steal about $3 million from fewer than 15 accounts. Polymarket pledged full refunds after that incident.