Polymarket Attack Drained $2.73 Million From 737 Accounts, Exposing a Third-Party Security Weakness

Polymarket reported a security incident involving a compromised third-party provider on October 29. Blockchain-data firm Bitquery traced approximately $2.73 million in unauthorised transfers from 737 affected accounts over about an hour. Polymarket said it would reimburse affected users; the reported transfer total is an investigator's estimate, not a final audited loss figure.

What the blockchain investigation found

Bitquery examined Polygon transactions on October 29 and identified 985 withdrawals involving 737 accounts between approximately 17:10 and 18:10 UTC. The research estimates a $2.73 million outflow, with the attacker routing assets through Polymarket's own transaction machinery. The figure is an on-chain estimate based on transactions and valuation assumptions, not a final audited loss statement.

The platform uses account-linked wallets and a relayer that submits approved transactions. Bitquery found that the withdrawals had valid approvals and that the relayer operated as designed. It found no evidence that the underlying smart contracts had been broken. Assets were converted into Polygon's POL token, distributed to new wallets and, in some cases, moved toward Ethereum through bridging services.

What Polymarket has confirmed

Polymarket's own status report identifies the entry point as a performance-monitoring script provided by an outside vendor. Attackers replaced that script with code designed to target people who had the website open during a brief period. It used their active sessions to sell positions and move funds out of their wallets.

The company suspended trading and relayer operations while investigating, removed the compromised script, cleared caches and reset active login sessions. It said it was implementing additional safeguards for third-party code, including tighter content-security policies, explicit version controls, sandboxing and ongoing integrity checks. Polymarket also said it referred the case to law enforcement.

A company update published October 30 said 95% of affected wallets had been refunded in full as of that afternoon. It put the total reimbursement program at $3.9 million: approximately $2.7 million associated with drained wallets plus $1.2 million for additional trading and pause-related losses. The larger number therefore should not be described as the amount directly stolen.

Why normal-looking transactions matter

The incident raises practical questions about software suppliers that can execute code inside financial applications. Analytics and performance tools may appear less sensitive than custody infrastructure, yet code loaded into the same page can have access to powerful context. The risk is amplified when trading and withdrawal workflows can be initiated from active sessions.

The unresolved questions

Bitquery's findings are a snapshot. The investigation notes that wallet labels can be incomplete and that its tracing window does not capture every later movement. Its published analysis also identified activity after the initial public indication that the issue had been fixed, although Polymarket subsequently marked the incident resolved. Those details make an accurate chronology important.

For readers following broader crypto market infrastructure, this episode follows other recent security disruptions, including those described in TTN Finance's reporting on Binance withdrawal operations. The mechanisms differ, and they should not be confused. The common lesson is that the reliability of crypto services depends on vendors, browsers, authentication and operational controls as much as on the blockchain ledger.