Users and on-chain sleuths have reported that the losses exceed $2.6 million as of now.
Polymarket was forced to temporarily restrict trading on Thursday after a security incident reportedly drained millions of dollars from user accounts.
The platform subsequently said it had identified and fixed the problem, which originated from a compromised external service rather than its core infrastructure.
The first signs of potential trouble emerged hours ago when multiple users reported unauthorized activity on their Polymarket accounts.
As the situation developed, the company put its international exchange into cancel-only mode, meaning users could remove existing orders but couldn’t submit new ones or execute new trades. The team also paused Relayer activity while it investigated.
Blockchain data tracked by Arkham showed a wallet believed to be linked to the attacker holding approximately $2.65 million worth of POL, following a series of USDC.e-to-POL swaps conducted through Relay. On-chain investigators confirmed that the amount is around that level, with some putting it at $2.7 million.
One affected trader claimed on X to have lost around $800,000, while another report suggested hundreds of transactions may have contributed to the total amount drained. Those individual figures were initially based on user and on-chain reports rather than Polymarket’s own accounting.
Polymarket said one of its external providers had been compromised and that the matter had been referred to law enforcement. It also pledged to fully reimburse affected traders and announced that the team had successfully identified the vulnerability and fixed it.
