Polymarket hacked, trading frozen as one bettor says $800K vanished

Polymarket, the world's biggest prediction market, had to slam on the brakes on the evening of October 29. At around 18:05 UTC the exchange switched to cancel-only mode: no new bets, and the relayer that signs transfers on users' behalf was paused.

About half an hour later the company owned up on its status page. It said one of its third-party providers had been compromised, the hole was found and fixed, the case was referred to law enforcement, and anyone affected will be made whole. Trading stays halted "out of an abundance of caution" while the platform comes back online.

Polymarket hasn't explained the mechanics. Based on user reports, the site was serving malicious signature requests when people connected their crypto wallets, so anyone who clicked approve was effectively handing over their own funds. There's no sign the smart contracts holding the money were breached; the attack went through the website and the outside code it loads.

The scale is known only from victims so far. A trader who goes by Car posted on X twenty minutes before the freeze that roughly $800,000 had been drained and all his positions sold, and that a friend lost about $600,000 more. Nobody has independently confirmed those numbers, and the company hasn't given a loss total or a victim count.

The awkward part: Polymarket went through something very similar in June, when tampered code from an outside vendor let attackers pull about $3 million from a handful of accounts. The company covered those losses too.

Until things are back to normal, the advice is simple: don't connect a wallet and don't sign anything. Decentralized or not, the door got opened through a contractor again.