Polymarket Halts Trading After Third-Party Breach Drains $2.7M From 700 Users

Approximately $2.73 million was drained from 737 Polymarket accounts after malicious code associated with a third-party monitoring script was used to exploit the platform, according to the incident details. The attackers carried out 985 withdrawals in roughly one hour, prompting Polymarket to halt trading while the breach was investigated.

The incident highlights the risks that can arise when a financial or trading platform depends on external software components. Although the withdrawals affected individual user accounts, the reported attack was linked not to a broad failure of the prediction-market system itself, but to code connected with an outside monitoring tool. That distinction is significant because third-party scripts can operate alongside a website or application while remaining outside the platform’s core infrastructure.

For users, however, the practical result was the same: funds were removed from their accounts in rapid succession. The number of withdrawals exceeded the number of affected accounts, indicating that at least some accounts were subject to multiple transactions during the attack. On average, the reported figures amount to slightly under $3,700 per affected account, though the distribution of losses may have varied considerably from one user to another.

Polymarket’s decision to stop trading was intended to contain the situation and prevent further activity while investigators examined the compromised component and the transactions associated with it. A trading halt can limit additional exposure, but it also prevents users from carrying out ordinary activity on the platform, including opening or closing positions. For a market built around continuously changing event probabilities, even a temporary interruption can create uncertainty over outstanding positions, settlement expectations and access to balances.

The incident also underscores the difference between a platform’s custody and security arrangements and the software that surrounds its user interface. Monitoring tools are commonly used to track market prices, activity and other data. They can improve visibility and functionality, but any script that interacts with a user’s browser, wallet connection or transaction process can become a potential point of attack if it is altered or compromised.

In this case, the malicious code was reportedly linked to a third-party monitoring script. The available details do not establish that Polymarket’s core trading engine was directly breached, nor do they describe the precise method used to authorize the withdrawals. Those questions are likely to be central to the investigation, particularly whether the attackers obtained signing permissions, redirected transactions, manipulated a browser-based workflow or exploited another connection between the monitoring software and users’ accounts.

The scale of the event is notable even by the number of transactions involved. Nearly 1,000 withdrawals were recorded within about an hour, suggesting an automated or highly coordinated operation rather than isolated manual thefts. The speed of the activity would make rapid detection and transaction monitoring especially important. Once a pattern of unauthorized withdrawals emerges, platforms generally need to identify affected accounts, preserve relevant logs, isolate compromised services and determine whether other users remain at risk.

For those who use prediction markets, the breach is a reminder that account security extends beyond passwords. Users may also depend on wallet permissions, browser extensions, connected applications and external tools that interact with market accounts. A compromise of any one of those elements can create exposure even when a user has not knowingly shared credentials.

The event may also intensify scrutiny of how platforms vet third-party services. External vendors and scripts are often updated frequently, and a legitimate tool can become dangerous if its code is tampered with, if an update introduces a vulnerability or if access controls are too broad. Strong separation between monitoring functions and transaction authorization can reduce the consequences of such a compromise, although the effectiveness of those safeguards depends on how they are implemented.

Polymarket users are likely to seek clarity on several issues as the platform responds: which accounts were affected, whether withdrawals can be reversed, how the unauthorized transactions were approved and whether the monitoring script has been disabled or isolated. The reported figures provide the initial scale of the loss, but they do not by themselves resolve questions about reimbursement, recovery or the timeline for restoring normal trading.

The halt therefore represents both an operational response and a test of the platform’s broader security procedures. Until the source of the malicious code and the path used to execute the withdrawals are fully understood, restoring activity could carry the risk of allowing a related exploit to continue. The breach places renewed attention on the safeguards required when trading systems, digital wallets and third-party software operate in close proximity.