Decentralized prediction market platform Polymarket restricted trading operations on Thursday after a security exploit involving a compromised external service provider drained between $2.65 million and $2.7 million from user accounts. The platform responded by putting its international exchange into cancel-only mode and temporarily pausing its Relayer activity to stop unauthorized transactions.
External Provider Vulnerability and On-Chain Activity
According to on-chain tracking data from Arkham, an attacker wallet accumulated approximately $2.65 million worth of POL tokens following a series of USDC.e-to-POL swaps processed through Relay. Blockchain researchers corroborated the estimates, noting the total drained funds range between $2.65 million and $2.7 million across hundreds of individual transactions. One impacted user reported on X that they lost roughly $800,000 in the incident.
Polymarket clarified that the security breach did not originate within its core infrastructure but stemmed from a compromised external third-party service. While investigating the issue alongside law enforcement, the team successfully identified and resolved the vulnerability. This event follows previous operational disruptions, including earlier trading halts on Polymarket. Polymarket assured customers that all affected traders will receive full reimbursements for their losses.
Key Takeaways
- Total Loss: Between $2.65 million and $2.7 million was drained across hundreds of unauthorized transactions.
- Asset Movement: Attackers swapped stolen USDC.e into POL using Relay.
- Platform Mitigation: Polymarket switched to cancel-only mode, paused Relayer activity, patched the vulnerability, alerted law enforcement, and committed to reimbursing all victims.
Why It Matters
This incident underscores how decentralized applications remain vulnerable to third-party integration risks even when their primary smart contracts remain uncompromised. As prediction platforms handle record volume, reliance on external relayers and service providers creates secondary attack vectors that malicious actors can exploit. Polymarket's prompt promise of complete financial reimbursement should help limit user attrition, but the platform will likely face heightened scrutiny regarding its middleware infrastructure.
