Polymarket freezes trading after third-party breach drains ~$2.7M from users — the second in five months

Polymarket, the prediction-market platform, put its exchange into "cancel-only mode" and paused its relayer on Thursday, October 29, after an attacker drained user accounts on its international venue. On-chain trackers put the losses at somewhere between $2.5 million and $2.7 million. The company says the root cause was a compromised third-party provider, that it has fixed the issue, and that it has referred the matter to law enforcement. Affected users, it says, will be made whole.

The sequence, as reported by The Block and CoinDesk, played out over a few hours. Users began posting on X that balances were leaving their accounts without authorization. CoinDesk says it independently confirmed that users with balances on Polymarket's international platform saw their accounts drained. Polymarket then posted that it was still investigating and that the exchange had been placed in cancel-only mode — meaning, in its own words, "You can cancel orders, but no new orders or trades are processing. Relayer actions are paused while we investigate." A later statement said the company had "found the cause," fixed it, and attributed the incident to a compromised outside vendor: "One of our third party providers was compromised, and we have referred this to relevant law enforcement." Its status page added that the problem was isolated to the international platform and that users would be made whole, with trading halted in the meantime.

The mechanics, as far as they're known

The clearest picture of where the money went comes from blockchain-analytics firm Arkham, cited by The Block. A wallet flagged as belonging to a suspected attacker held roughly $2.65 million in POL (Polygon's token) after a series of recent swaps from USDC.e into POL routed through Relay, a cross-chain bridging tool. The Block reports the funds were subsequently moved on to other addresses — the standard laundering step that follows most on-chain thefts.

The loss figure is not settled, and the discrepancies are worth stating plainly. The Block's headline and body cite about $2.65 million, matching the Arkham wallet balance, while noting the figure moved from "over $2.5 million" to "over $2.6 million" as the situation developed. CoinDesk initially reported $2.5 million, then updated to cite DeFi Llama's tracking of "some $2.7 million" in losses — explicitly flagging the revision in two timestamped updates (19:33 and 19:39 UTC). Both outlets are drawing on on-chain data rather than any official tally; Polymarket itself has not published a loss figure. Call it roughly $2.5 million to $2.7 million, pending confirmation.

Exactly which third-party provider was breached, and how, has not been disclosed. The detail that "relayer actions" were paused points toward Polymarket's order-relay infrastructure — the off-chain plumbing that routes signed orders to the on-chain settlement layer — but neither the company nor the reporting specifies the compromised vendor or the attack vector.

Key facts

• What happened: Polymarket placed its exchange in cancel-only mode and paused relayer actions after an attacker drained user accounts on its international venue. (The Block, CoinDesk, citing Polymarket's X posts and status page)
• Losses: Roughly $2.65 million per Arkham's tracking of a suspected attacker wallet (The Block); about $2.7 million per DeFi Llama (CoinDesk), revised up from an initial $2.5 million estimate. No official figure from Polymarket.
• How the funds moved: Multiple USDC.e-to-POL swaps through Relay, leaving ~$2.65 million in POL in the flagged wallet, since moved to other addresses. (Arkham, via The Block)
• Cause, per Polymarket: A compromised third-party provider; issue said to be identified and fixed; referred to law enforcement. (Polymarket statement, via both outlets)
• Scope: Limited to the international platform; users told they will be made whole. (Polymarket status page, via CoinDesk)
• Not the first time: In June 2026, a separate third-party vendor breach hit Polymarket's front-end, with roughly $3 million taken from users. (CoinDesk)
• Date: October 29, 2026. Still developing as of publication.

The real-world read

The phrase doing the heavy lifting here is "third-party provider was compromised." It is technically a description and functionally a deflection: it locates the failure outside Polymarket's own code. That framing is harder to accept the second time you hear it. By CoinDesk's account, this is the second breach in five months traced to an outside vendor — June's incident hit the front-end through a different third party and cost users around $3 million. Two vendor compromises draining seven figures each, in the same year, is a pattern about who a platform chooses to trust with its users' funds, not a run of bad luck. "A vendor was compromised" does not answer the question of why a vendor was positioned to drain customer balances at all.

Several things are conspicuously unsaid. Polymarket has not named the compromised provider, described the vulnerability, or explained how a third party's breach translated into unauthorized withdrawals — the most important mechanical detail, and the one still missing. Nor has it put a number on the losses; the only figures in circulation come from Arkham and DeFi Llama reading the chain, and they don't fully agree. That the company's own estimate is absent while outside trackers do the counting is itself telling.

The "users will be made whole" line deserves to be held at arm's length until it is executed. It is a promise from the affected party, made in the same breath as the disclosure, with no stated timeline, mechanism, or confirmation that reimbursements have begun. It may well be honored — Polymarket is a large, well-capitalized platform — but a stated intention is not a completed refund, and it should not be reported as one.

One point in the reporting's favor: the loss figures rest on on-chain evidence, which is about as close to a primary source as these situations offer. Arkham's wallet attribution and DeFi Llama's tracking can be independently inspected, which is more than can be said for the company's unquantified "we've fixed it." The gap between the two estimates ($2.65M vs. $2.7M) is small and consistent with a still-moving situation, not a contradiction to resolve.

Opinion, and whose

• Polymarket characterizes the incident as externally caused ("one of our third party providers was compromised"), says it is fixed, and states users will be made whole. These are the company's assertions about its own breach; the fix and the reimbursement remain unverified as of publication.
• Neither The Block nor CoinDesk offers a forecast or a verdict on Polymarket's handling; both frame the story as developing. CoinDesk supplies the comparative context — that this is the second vendor-linked breach in recent months — which is reporting, not opinion, but it is the most pointed editorial choice in the coverage.

Sources

• The Block (Tier 2, reputable secondary), "Polymarket pauses trading after $2.65 million exploit…," Oct. 29, 2026 — provided the cancel-only / relayer-pause mechanics, Polymarket's statements, and the Arkham wallet tracing (USDC.e-to-POL swaps via Relay, ~$2.65M, funds since moved). Flagged a figure that rose from $2.5M to $2.6M+ during reporting.
• CoinDesk (Tier 2, reputable secondary), "Polymarket suspends trading after third-party breach leads to user losses," Oct. 29, 2026 — confirmed the breach hit the international venue and that users saw accounts drained, cited DeFi Llama's ~$2.7M figure (revised up from $2.5M in timestamped updates), and supplied the June 2026 ~$3M front-end breach for context, plus the "users made whole" statement.
• Decrypt — the retrieved article under the Polymarket headline contained unrelated content (a Department of Homeland Security data-leak story) and provided no facts bearing on this incident; it was not used.

No source here was sponsored or marketing material; all three are independent newsroom reports. Loss figures originate from on-chain analytics (Arkham, DeFi Llama), not from Polymarket itself.

This is news reporting, not financial advice. Nothing here is a recommendation to buy, sell, or hold anything.