Prediction market platform Polymarket halted all new trading on Oct. 29, 2026, roughly 20 minutes after a user reported that $800,000 was drained from their account in a potential exploit. The freeze leaves the exchange in cancel-only mode as total reported user losses reach $1.4 million.
Accounts Drained and Trading Halted
At 17:45 UTC, an X user named Car warned traders to lock down their accounts, stating that their entire balance of $800,000 had been liquidated and transferred without authorization. Car added that a friend lost $600,000 in a similar manner, bringing the initial reported losses to $1.4 million. By 18:05 UTC, Polymarket updated its status page to flag a major outage, moving the platform into cancel-only mode and pausing its relayer infrastructure—the developer system responsible for sending token transfers and spending approvals on behalf of users.
While traders can cancel pending orders, buying and selling remain disabled. Polymarket has not officially confirmed whether a breach occurred, nor has it verified the exact loss total or victim count.
Security Concerns Mount Across Prediction Markets
The incident follows a previous exploit in June 2026, when attackers altered third-party web code to trick users into approving unauthorized token transfers. During that attack, roughly $3 million in pUSD—the dollar-pegged collateral used on the platform—was stolen across fewer than 15 accounts. At the time, William LeGate, Polymarket head of experience, confirmed the platform refunded affected users in full, though no compensation pledge has been issued for the latest outage.
The freeze also comes just two days after rival prediction market Predict.fun suffered an attack resulting in a $400,000 loss. As vulnerabilities impact decentralized platforms, security surrounding wallet approvals across crypto super apps and interfaces remains under intense scrutiny.
Key Takeaways
- Polymarket paused new trading and entered cancel-only mode at 18:05 UTC on Oct. 29, 2026.
- Trader Car reported an $800,000 account drain alongside a $600,000 loss from a friend.
- The platform previously suffered a $3 million pUSD front-end exploit in June 2026 affecting fewer than 15 accounts.
- Rival platform Predict.fun lost $400,000 in an attack two days prior.
Why It Matters
This latest disruption underscores the persistent vulnerability of Web3 front-ends and relayer infrastructure, which remain prime targets even when smart contracts remain unbreached. With prediction markets attracting record liquidity and engagement, consecutive security failures at Predict.fun and Polymarket risk damaging user confidence. Whether Polymarket extends its previous refund playbook to cover these latest user losses will serve as a key test for platform trust.
