{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Polymarket halts trading after a compromised third-party provider drains user wallets through its website · updates",
  "home_page_url": "https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026",
  "feed_url": "https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026/feed.json",
  "description": "On Oct 29 2026 Polymarket users reported their accounts being drained after using polymarket.com; one trader said he lost $800,000 and a friend $600,000 (user claims, not confirmed by Polymarket). At 18:05 UTC Polymarket put the exchange in cancel-only mode and paused relayer actions. At 18:37 UTC it said one of its third-party providers was compromised, that it had identified and fixed the issue on Polymarket.com, referred it to law enforcement, and that anyone impacted will be made whole; it then halted trading. At 19:00 UTC Polymarket said trading was fully back online and that it is fully reimbursing all affected traders, and at 19:05 UTC its status page marked the incident resolved. Polymarket has not named the provider or a loss total. The Block, citing Arkham data, reports a suspected attacker wallet holding about $2.65M, and CoinDesk cites DeFi Llama tracking about $2.7M in losses. A person familiar with the matter told CNBC the compromised provider was web-performance service DebugBear and that the case went to UK law enforcement; Hudson Rock told Decrypt a DebugBear-hosted script contained wallet-draining code. Polymarket's US platform was not affected, and no smart-contract exploit has been reported. It is the second time this year: in June, tampered outside-vendor code on the site drained about $3M. If you used the site on Oct 29, check your account for withdrawals you didn't make.",
  "language": "en",
  "_pwn": {
    "slug": "polymarket-frontend-third-party-provider-drain-oct-2026",
    "severity": "high",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026/feed.xml",
    "llms": "https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026/llms.txt",
    "json": "https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026#2026-10-29-711311c8",
      "url": "https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026#2026-10-29-711311c8",
      "title": "Polymarket halts trading after a compromised third-party provider drains user wallets through its website: Polymarket's status page marks the incident resolved.",
      "content_text": "Polymarket halts trading after a compromised third-party provider drains user wallets through its website: Polymarket's status page marks the incident resolved.\n\nSource: https://status.polymarket.com/history/1",
      "date_published": "2026-10-29T19:05:00.000Z",
      "external_url": "https://status.polymarket.com/history/1",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026#2026-10-29-adc71780",
      "url": "https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026#2026-10-29-adc71780",
      "title": "Polymarket halts trading after a compromised third-party provider drains user wallets through its website: Polymarket says trading is fully back online and that it is fully reimbursing all affected traders.",
      "content_text": "Polymarket halts trading after a compromised third-party provider drains user wallets through its website: Polymarket says trading is fully back online and that it is fully reimbursing all affected traders.\n\nSource: https://x.com/PolymarketTrade/status/2115881498477785393",
      "date_published": "2026-10-29T19:00:00.000Z",
      "external_url": "https://x.com/PolymarketTrade/status/2115881498477785393",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026#2026-10-29-78f8bafe",
      "url": "https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026#2026-10-29-78f8bafe",
      "title": "Polymarket halts trading after a compromised third-party provider drains user wallets through its website: Polymarket's status page moves to monitoring: a fix is out and trading will resume at approximately 3pm ET.",
      "content_text": "Polymarket halts trading after a compromised third-party provider drains user wallets through its website: Polymarket's status page moves to monitoring: a fix is out and trading will resume at approximately 3pm ET.\n\nSource: https://status.polymarket.com/history/1",
      "date_published": "2026-10-29T18:55:00.000Z",
      "external_url": "https://status.polymarket.com/history/1",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026#2026-10-29-386ec4af",
      "url": "https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026#2026-10-29-386ec4af",
      "title": "Polymarket halts trading after a compromised third-party provider drains user wallets through its website: Polymarket says one of its third-party providers was compromised, it has identified and fixed the issue on Polymarket.com, referred it to law enforcement, and anyone impacted will be made whole; trading stays halted while the platform is brought back online.",
      "content_text": "Polymarket halts trading after a compromised third-party provider drains user wallets through its website: Polymarket says one of its third-party providers was compromised, it has identified and fixed the issue on Polymarket.com, referred it to law enforcement, and anyone impacted will be made whole; trading stays halted while the platform is brought back online.\n\nSource: https://status.polymarket.com/history/1",
      "date_published": "2026-10-29T18:37:00.000Z",
      "external_url": "https://status.polymarket.com/history/1",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026#2026-10-29-eb32713c",
      "url": "https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026#2026-10-29-eb32713c",
      "title": "Polymarket halts trading after a compromised third-party provider drains user wallets through its website: Polymarket's status page reports a major outage: the exchange is in cancel-only mode and relayer actions are paused while it investigates an incident.",
      "content_text": "Polymarket halts trading after a compromised third-party provider drains user wallets through its website: Polymarket's status page reports a major outage: the exchange is in cancel-only mode and relayer actions are paused while it investigates an incident.\n\nSource: https://status.polymarket.com/history/1",
      "date_published": "2026-10-29T18:05:00.000Z",
      "external_url": "https://status.polymarket.com/history/1",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026#2026-10-29-c3993384",
      "url": "https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026#2026-10-29-c3993384",
      "title": "Polymarket halts trading after a compromised third-party provider drains user wallets through its website: A Polymarket trader posts that $800,000 was drained from his account, all his positions were sold and a friend lost $600,000, and warns users not to interact with the site.",
      "content_text": "Polymarket halts trading after a compromised third-party provider drains user wallets through its website: A Polymarket trader posts that $800,000 was drained from his account, all his positions were sold and a friend lost $600,000, and warns users not to interact with the site.\n\nSource: https://x.com/CarOnPolymarket/status/2115862718452298234",
      "date_published": "2026-10-29T17:45:00.000Z",
      "external_url": "https://x.com/CarOnPolymarket/status/2115862718452298234",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026#2026-10-29-91a7c1ce",
      "url": "https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026#2026-10-29-91a7c1ce",
      "title": "Polymarket halts trading after a compromised third-party provider drains user wallets through its website: The Block reports, citing Arkham data, that a wallet identified as the suspected attacker holds about $2.65M in POL after USDC.e-to-POL swaps through Relay; CoinDesk says DeFi Llama tracks about $2.7M in losses.",
      "content_text": "Polymarket halts trading after a compromised third-party provider drains user wallets through its website: The Block reports, citing Arkham data, that a wallet identified as the suspected attacker holds about $2.65M in POL after USDC.e-to-POL swaps through Relay; CoinDesk says DeFi Llama tracks about $2.7M in losses.\n\nSource: https://www.theblock.co/news/defi/2026-10-29-polymarket-exploit-2-5-million-cancel-only-mode-432158",
      "date_published": "2026-10-29T00:00:00.000Z",
      "external_url": "https://www.theblock.co/news/defi/2026-10-29-polymarket-exploit-2-5-million-cancel-only-mode-432158",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026#2026-10-29-becc63ff",
      "url": "https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026#2026-10-29-becc63ff",
      "title": "Polymarket halts trading after a compromised third-party provider drains user wallets through its website: Hudson Rock tells Decrypt a script loaded from DebugBear contains code that looks for a logged-in trading session, sells positions and transfers the assets, with the suspected attacker wallet hard-coded as fallback recipient.",
      "content_text": "Polymarket halts trading after a compromised third-party provider drains user wallets through its website: Hudson Rock tells Decrypt a script loaded from DebugBear contains code that looks for a logged-in trading session, sells positions and transfers the assets, with the suspected attacker wallet hard-coded as fallback recipient.\n\nSource: https://decrypt.co/382185/polymarket-pauses-trading-prediction-market-security-incident",
      "date_published": "2026-10-29T00:00:00.000Z",
      "external_url": "https://decrypt.co/382185/polymarket-pauses-trading-prediction-market-security-incident",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026#2026-10-29-bf699f56",
      "url": "https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026#2026-10-29-bf699f56",
      "title": "Polymarket halts trading after a compromised third-party provider drains user wallets through its website: A person familiar with the matter tells CNBC the issue stemmed from a hack of DebugBear and was referred to UK law enforcement; analytics firms told CNBC an account withdrew at least $2.7M across 710 wallets. Polymarket's US platform was not compromised.",
      "content_text": "Polymarket halts trading after a compromised third-party provider drains user wallets through its website: A person familiar with the matter tells CNBC the issue stemmed from a hack of DebugBear and was referred to UK law enforcement; analytics firms told CNBC an account withdrew at least $2.7M across 710 wallets. Polymarket's US platform was not compromised.\n\nSource: https://www.cnbc.com/2026/10/29/polymarket-reports-outage-on-international-exchange-halts-trading.html",
      "date_published": "2026-10-29T00:00:00.000Z",
      "external_url": "https://www.cnbc.com/2026/10/29/polymarket-reports-outage-on-international-exchange-halts-trading.html",
      "tags": [
        "high"
      ]
    }
  ]
}