Polymarket restores trading, pledges refunds after $2.7M breach estimate
An outside provider’s security incident prompted an emergency trading pause, with Polymarket promising to cover affected traders’ losses.
Polymarket has restored trading on its international platform after a security incident involving an outside service provider on October 29. The prediction market said it had fixed the issue, contacted law enforcement and would be fully reimbursing all traders who were affected by it.
Bubblemaps believes that about $2.7 million was stolen, with affected customers waiting on more details.
Trading returns after emergency pause
Polymarket initially restricted its exchange to cancel-only mode, allowing customers to withdraw existing orders while new trades stopped processing. It also paused the service that submits transactions on behalf of the users.
After that, the company reported the compromise of one of its third-party providers and paused trading to restore the platform.
A later update from their Polymarket Traders account confirmed trading was now fully back online. In the same update, it was promising to offer a full repayment to its affected traders, but it did not provide a repayment schedule or requirements for filing claims.
Polymarket said the affected service is its international platform.
Bubblemaps follows the missing funds
In its October 29 report, Bubblemaps traced funds from hundreds of deposit wallets into an address it identified as the attacker’s.
The diagram seen showed 712 deposit wallets and about $2.71 million moving through the main route. It said the funds were converted into POL [Polygon’s native token] and distributed to several addresses. It also tracked transfers to Ethereum.
These are figures from Bubblemaps, as Polymarket has not confirmed those details.
Outside website services come under scrutiny
Researchers examining the incident linked suspicious code to a website performance-monitoring service. Such tools normally help companies understand how their websites load and function.
According to their analysis, malicious code accessed users’ trading sessions and initiated actions that moved assets from their accounts. The detailed attack method is still under investigation.
A full analysis of the event is expected from the Polymarket team. Also, users will be expecting updates about reimbursements that will say which accounts qualify, how losses are calculated, and when customers receive their funds.
Final Summary
- Polymarket restored international trading and promised full reimbursement following a third-party security incident.
- Bubblemaps estimated losses of about $2.7 million, but Polymarket itself has not yet disclosed the total loss.
