- Trending
- Comments
- Latest
Polymarket briefly suspended trading on Thursday after a compromised third-party service exposed visitors to malicious code, with analysts estimating about $2.7 million in losses. The prediction market restored trading around 3:00 p.m. ET, referred the incident to law enforcement and said it is fully reimbursing affected traders.
Polymarket disclosed the security incident at approximately 2:33 p.m. Eastern Time on Thursday, confirming that a third-party provider supporting its international website had been compromised.
The company temporarily halted trading while addressing the problem, preventing further trading activity until the affected systems could be secured.
In a statement published on X, Polymarket acknowledged the breach and outlined its immediate response.
“We’ve identified and fixed an issue impacting our international platform, Polymarket.com. One of our third-party providers was compromised, and we have referred this to relevant law enforcement,” — Polymarket, in an official statement on X.
The company also assured users that anyone who suffered financial losses from the incident would receive compensation.
The temporary suspension was intended to limit further exposure while the platform worked to restore normal operations.
Although the Polymarket exploit disrupted trading, the company indicated that the underlying issue had been identified and resolved before activity resumed.
Trading restarted at approximately 3:00 p.m. Eastern Time, marking the end of the temporary suspension.
The incident nevertheless highlighted how a security breach involving an external technology provider can affect users of a cryptocurrency platform, even when the attack originates outside its primary infrastructure.
Blockchain analysts subsequently examined transactions associated with the Polymarket exploit, identifying an estimated $2.7 million in cryptocurrency losses linked to the security breach.
The reported figure came from independent analysis rather than an official loss assessment released by Polymarket.
Pseudonymous developer 0xngmi, who created the decentralized finance analytics platform DeFiLlama, discussed the suspected attack mechanism in a post on X.
“Attacker attacked a company that does web performance tracking and whose scripts were being pulled on Polymarket, so everyone who visited polymarket got exposed,” — 0xngmi, DeFiLlama developer, on X.
According to the developer’s explanation, the attackers targeted an external company responsible for website performance monitoring.
Because the provider’s scripts were integrated into Polymarket’s website, visitors could potentially encounter the compromised code while accessing the trading platform.
The explanation suggests that the intrusion originated through a third-party software dependency rather than through the direct compromise of the prediction market’s core trading systems.
Importantly, 0xngmi indicated that users’ cryptocurrency wallet seed phrases remained safe, distinguishing the incident from attacks involving the theft of private wallet recovery credentials.
Nevertheless, the Polymarket exploit demonstrated how malicious scripts introduced through external services can expose users to financial losses.
The precise number of affected accounts was not disclosed in the original report, and the estimated financial damage remained based on analysts’ findings.
Following the restoration of trading, Polymarket reiterated its commitment to compensate traders affected by the security breach.
“We’ll make this right and are fully reimbursing all affected traders,” — Polymarket, in a follow-up statement on X.
The announcement provided reassurance to users whose funds had been affected, although the company did not specify a reimbursement timeline in the reported statement.
The Polymarket exploit also prompted the platform to involve relevant law enforcement authorities, indicating that the incident was being treated as a security matter requiring further investigation.
At the time of the announcement, Polymarket had not publicly detailed the identity of the compromised service provider in the supplied report.
The combination of a temporary trading suspension, an external provider compromise, and reported cryptocurrency losses placed renewed attention on the security risks associated with third-party integrations.
While trading resumed relatively quickly, the incident illustrated that restoring platform operations and addressing users’ financial losses are separate aspects of responding to a security breach.
For affected traders, the central issue remained the recovery of stolen funds and the implementation of safeguards against similar attacks.
The latest Polymarket exploit follows an earlier security incident in May 2026, when the platform reportedly suffered approximately $700,000 in cryptocurrency losses.
That breach involved a compromised private key that had been used for internal operations for six years.
Blockchain analytics firm Bubblemaps reported that attackers transferred POL tokens through 16 cryptocurrency addresses, including addresses associated with exchanges.
Following the May incident, Polymarket confirmed the security breach but maintained that customer funds, smart contracts, and market resolution systems had not been affected.
The company subsequently rotated the compromised key, revoked production permissions, and announced plans to migrate its private keys to a more secure key management system.
Although the earlier attack involved internal credentials and the October incident concerned an external service provider, both cases underscored different security risks facing cryptocurrency-based prediction markets.
The October Polymarket exploit placed particular emphasis on dependencies that platforms may rely on for website functionality, including externally supplied scripts.
Such integrations can introduce risks when a service provider’s systems are compromised, potentially exposing users even without a direct attack on the platform’s underlying infrastructure.
Polymarket’s commitment to reimburse affected traders addresses the immediate financial consequences, but the incident also raises broader questions about how external software dependencies are monitored and secured.
With trading restored and the reported losses estimated at approximately $2.7 million, the Polymarket exploit serves as another example of the security challenges confronting cryptocurrency platforms as they rely on interconnected technology providers.
For Polymarket, the immediate priority remains fulfilling its reimbursement commitment and ensuring that the vulnerability responsible for the incident cannot be exploited again.
Copyright © 2025 - The Bit Gazette.
