Polymarket has said it has fixed an issue affecting its international platform after a third-party provider was compromised, while StarPlatinum has alleged that users lost $2.68 million.
Summary
- Polymarket has restricted trading and paused relayer actions while investigating an incident.
- A trader named Car reported losing $800,000 and said all his positions were sold.
- StarPlatinum alleged $2.68 million in losses, without official confirmation of the amount or cause.
- Polymarket said a third-party provider was compromised and referred the incident to law enforcement.
Polymarket’s incident notice records the disruption at 18:05 UTC and classifies it as a major outage affecting its Predictions Trading API, known as the CLOB.
Polymarket fixes issue and refers incident to law enforcement
Polymarket Status said the company had identified and fixed the issue affecting its international platform, attributing the incident to a compromised third-party provider. The company said it had referred the matter to relevant law enforcement.
In a subsequent update, the status account said a fix had been deployed and was being monitored. Trading was scheduled to resume at approximately 3 p.m. ET on Oct. 29.
The announcement did not name the provider, confirm the reported losses or announce reimbursement terms.
Traders report losses and suspect a frontend compromise
Posting on X, a trader using the name Car said his account had been drained of $800,000 and claimed a friend had lost $600,000. In a reply, he wrote, “All my positions were sold,” linking to his public Polymarket profile.
In a subsequent post, Car described precautions he said he routinely takes, including separating personal activity, development, and trading across different devices. He suspected a frontend compromise because multiple users appeared to be affected, but presented that explanation as a possibility.
Jeremy, another X user, described Polymarket as being hacked and said its frontend was reportedly compromised. His post included the platform’s outage notice and an image of a wallet message-signing request displaying the Polymarket domain.
The signing image shows a data field labeled “DepositWallet,” chain ID 137, and an “Unverified” indicator. The image does not display a completed transaction, a transaction hash, or the full verifying-contract field.
A separate account, StarPlatinum, alleged that hundreds of withdrawals had passed through Polymarket’s deposit-wallet infrastructure, with a recipient wallet accumulating funds over roughly an hour.
According to that account’s timeline, the wallet began receiving funds at 17:05 UTC, held $412,000 by 17:25, reached $2.02 million at 17:50 and peaked at $2.68 million at 18:05. Suspicious activity was still being recorded at 18:10, the post claimed.
StarPlatinum identified a suspected recipient address and a Deposit Wallet Factory proxy, and alleged that Relay’s sponsored transaction infrastructure was involved. The account explicitly said suspicions of a compromised frontend had not been officially confirmed.
The same post claimed the recipient accumulated 28.6 million POL, with funds being converted from user deposit balances.
The figures remain social media estimates. Polymarket’s examined statements did not confirm the reported individual losses, the aggregate amount, the recipient’s identity, or the proposed transaction route.
June’s Polymarket attack prompted a refund pledge
In June, Polymarket acknowledged that a compromised third-party vendor had allowed a malicious script into its frontend for some users, as crypto.news previously reported in coverage of its earlier refund pledge.
The company said it had contained the incident, removed the affected dependency, and was contacting affected customers to reimburse them in full. Blockchain analyst Specter initially estimated that $2.94 million had been taken from at least 11 wallets.
A subsequent loss estimate reached $3.1 million, according to AMLBot. In its June 27 assessment, the firm described funds being taken in PUSD on Polygon, converted through Relay, bridged to Ethereum and swapped into ETH.
The earlier reimbursement commitment concerned the June incident. The Oct. 29 notices examined contained no equivalent promise concerning the newly reported losses.
Separate US venue operates under federal derivatives rules
Polymarket’s international blockchain platform and its regulated US exchange operate as distinct venues. Coverage updated July 31 describes the international service as wallet-based, while the American exchange operates through a CFTC-licensed exchange and clearing organization.
The Oct. 29 incident notice examined names the Predictions Trading API on the international service’s status site. It does not identify the separate American exchange as an affected venue.
Elsewhere in prediction markets, Predict.fun confirmed unauthorized wallet transfers totaling approximately 400,000 USDT in an Oct. 27 statement. Its preliminary investigation pointed to a possible compromise of an externally hosted API documentation site.
Predict.fun said the affected documentation site would remain offline during its investigation and promised full reimbursement for losses directly resulting from that incident. The company committed to publishing a detailed post-mortem after completing the investigation.
