Summary
Polymarket has placed its international exchange into cancel-only mode and paused relayer activity after users reported unauthorized asset withdrawals. The platform is also investigating suspicious trades linked to an Israeli election market, bringing supply-chain security, market integrity, and regulatory oversight into focus.
A protective trading shutdown
Polymarket has restricted activity on its international platform after users reported that assets may have been withdrawn without authorization. The platform’s status information showed its trading API in a major outage and the exchange operating in cancel-only mode. In practical terms, users could cancel existing orders but could not submit new ones. Polymarket also paused relayer actions, which are used to submit users’ signed transactions to the blockchain.
The measures represent a protective interruption rather than a completed assessment of the incident. By limiting order placement and transaction submission, the platform can reduce the chance that additional suspicious activity will be executed while investigators work to establish the scope and entry point of the compromise. At the same time, such a shutdown disrupts market continuity and can make it harder for participants to understand the status of pending orders, balances, and settlement processes.
Polymarket later said that one of its third-party providers had been compromised and that the matter had been referred to relevant law enforcement. The company also said that anyone affected would be made whole. The available information does not identify the provider, specify how many accounts were affected, or provide a total loss figure. It also does not yet explain the precise conditions or timeline for any reimbursement. Those details will be important for determining how the platform handled customer protection and incident disclosure.
The supply-chain risk behind a wallet attack
The reported details point beyond a conventional password breach. Security firm Hudson Rock said that a script hosted through DebugBear contained wallet-draining code and hard-coded the same address later identified as the suspected attacker’s destination. If confirmed, that would place the front end and third-party software supply chain at the center of the investigation.
For applications that rely on user-controlled wallets, the front end is part of the security boundary. A user may visit the expected website, connect a wallet, and see an interface that appears normal while the underlying transaction request has been altered. The private key does not necessarily need to be exposed for assets to be lost. A compromised script, a malicious dependency, a changed analytics component, an altered wallet prompt, or an attacker-controlled transaction relay can all affect what a user is asked to sign or what is ultimately broadcast.
This is why third-party risk extends beyond a traditional custody provider. Website monitoring tools, analytics scripts, customer-support systems, wallet-connection libraries, transaction relayers, and cross-chain services may each occupy a position in the asset-operation chain. If one of those components can influence transaction presentation, authorization, or broadcasting, a software compromise can become a direct financial-security incident.
On-chain data cited in the reporting showed a wallet identified as the suspected attacker’s holding about $2.65 million in POL, Polygon’s native token. The wallet had received several swaps from USDC.e into POL through Relay. Such data can help investigators map transaction timing and the movement of assets. It does not, by itself, establish ownership or criminal responsibility. A wallet label supplied by a blockchain intelligence platform should be treated as an investigative lead rather than a judicial conclusion, particularly when funds have moved through exchanges, bridges, or swapping services.
A separate test of market integrity
The security incident is unfolding alongside a separate investigation into suspicious profit-making trades related to an Israeli election market. The available reporting does not establish that the unusual trades were caused by the third-party compromise, nor does it identify the traders or provide a final determination about whether the activity violated market rules.
That distinction matters. Suspicious trading is not automatically proof of insider trading, manipulation, or proceeds from an attack. However, the coincidence of a possible front-end compromise and unusual activity around a politically sensitive market raises broader questions about how prediction markets monitor access, information advantages, coordinated activity, and account behavior.
A prediction market’s credibility depends on more than whether orders can be matched. Participants also need confidence that the market’s rules are applied consistently, that sensitive information is handled appropriately, that unusual accounts are reviewed in a timely manner, and that settlement and dispute procedures are auditable. Markets linked to elections can attract intense attention and may create additional expectations around surveillance and disclosure.
The two investigations also create a difficult operational trade-off. Suspending trading can reduce immediate asset and authorization risk, but it interrupts price discovery and leaves users unable to place or adjust orders. Continuing to operate while the integrity of the front end or relayer remains uncertain could create a more serious problem: market data may no longer reflect valid user intent, and the status of signed transactions may be disputed. A credible response therefore requires both technical containment and clear communication about what functions remain safe to use.
Implications for institutional wallets and custody controls
For institutional participants, the central lesson is not simply that one script may have been compromised. It is that multiple components can sit between an institution’s policy and an on-chain transaction. Front-end access, transaction simulation, signing approval, broadcasting, treasury movement, and reconciliation should not all depend on a single service or operator.
Institutional wallet programs commonly seek to separate these functions through role-based permissions, independent approval, address screening, transaction simulation, and limits on what a signer or service can authorize. Multi-party approval can reduce the impact of a single compromised account or interface, although it does not eliminate the need to validate the transaction request itself. If all approvers rely on the same compromised display or front end, multiple signatures may not provide meaningful independent review.
Incident-response planning is equally important. Organizations need defined triggers for disabling a relayer, freezing a workflow, revoking a vendor’s access, and communicating a suspected compromise. They also need reliable logs showing what a user saw, what was signed, which service broadcast the transaction, and where funds moved afterward. Because many blockchain transactions are difficult or impossible to reverse once broadcast, post-incident investigation cannot substitute for pre-signing controls.
The event should not be read as proof that every prediction market, non-custodial wallet, or third-party service uses the same architecture. Non-custodial systems can reduce certain centralized custody risks, but they also distribute responsibility across user authorization, interface integrity, vendor management, and operational procedures. Institutions assessing such platforms need to examine those controls alongside market rules, liquidity, and settlement design.
Regulatory scrutiny may intensify
Prediction markets occupy a complicated position at the intersection of trading venues, information markets, and blockchain applications. A security incident involving a third-party provider, possible unauthorized withdrawals, paused trading, and suspicious election-related activity gives regulators several areas to examine at once.
Potential questions include how the platform defines responsibility for user assets, what disclosures are required when trading is suspended, how it monitors market abuse, and whether its vendor-management program is proportionate to the authority granted to third parties. Regulators may also focus on how the platform distinguishes technical compromise from improper trading, preserves evidence, handles affected users, and communicates uncertainty during an investigation.
Polymarket has said it is cooperating with law enforcement and will make affected users whole. The next stage will depend on whether the company can identify the attack path, establish the scope of affected assets, clarify the outcome of the election-market investigation, and describe concrete changes to supplier review, front-end deployment, transaction authorization, and relayer controls.
For now, the episode is best understood as an ongoing security and market-governance investigation, not as a final judgment on prediction markets or any specific wallet architecture. The most consequential indicators will be the quality of the evidence released, the transparency of any reimbursement process, the handling of suspicious trades, and whether the platform can demonstrate durable improvements rather than only a temporary trading pause.
Source: link