Polymarket temporarily suspended trading after hackers exploited a third-party website vulnerability, stealing approximately $2.6 million from user accounts and raising fresh cryptocurrency security concerns.
Cryptocurrency prediction market platform Polymarket temporarily suspended parts of its operations on Thursday after hackers exploited a security vulnerability involving an external technology provider. The incident reportedly resulted in losses of at least $2.6 million from user accounts.
The attack targeted Polymarket's international platform, where several traders reported unauthorised withdrawals and unexpected liquidations of their digital asset holdings. Some individual users reportedly suffered losses of up to $800,000.
The breach has raised concerns about third-party software security and the risks associated with cryptocurrency trading platforms.
Preliminary investigations by blockchain researchers and cybersecurity firm Hudson Rock indicated that the incident was connected to a compromised website monitoring script supplied by DebugBear, a UK-based third-party technology provider.
The malicious code was reportedly inserted into Polymarket's frontend through the compromised external script.
According to security findings, attackers used the vulnerability to access active user trading sessions, liquidate open positions and transfer converted cryptocurrency holdings into wallets under their control.
This allowed the attackers to move funds without directly compromising Polymarket's core blockchain smart contracts. The incident highlights how vulnerabilities in external software components can expose online platforms and their users to security risks.
Blockchain analysis provided further details about the scale and movement of funds involved in the attack. According to on-chain investigations by Arkham, more than 900 suspicious transactions passed through Polymarket's transaction relayer infrastructure.
The stolen funds were subsequently exchanged into POL, the native token of the Polygon network, before being transferred through attacker-controlled wallets.
These transactions helped researchers examine the movement of the affected digital assets and investigate the possible route used by the hackers.
The incident also demonstrated how blockchain transaction records can assist security researchers in tracking suspicious cryptocurrency movements.
Following reports of unauthorised withdrawals, Polymarket quickly introduced emergency restrictions to prevent further losses.
The international platform was shifted into a restricted 'cancel-only' mode. This prevented users from opening new positions or executing fresh orders while allowing them to cancel existing open bids.
The company also temporarily suspended its backend relayer infrastructure. The relayer is an automated system that helps process and execute user transactions on the blockchain. Suspending this service was intended to cut off the transaction pathway being exploited by attackers.
These emergency measures helped the platform contain the incident while its technical teams investigated the vulnerability.
Polymarket confirmed that its core smart contracts were not compromised during the security incident. According to the company, the attack was limited to an external frontend dependency rather than the underlying blockchain infrastructure.
Technical teams identified and addressed the vulnerability, allowing normal trading operations to resume approximately one hour after the disruption.
In its statement, Polymarket acknowledged that one of its external partners had been compromised. The company also assured affected traders that they would receive full reimbursement for their lost balances.
Additionally, Polymarket referred the incident to law enforcement authorities in the United Kingdom to support investigations and identify those responsible for the attack.
The Polymarket incident occurred amid broader concerns about cryptocurrency security following a separate major security breach involving Binance, the world's largest cryptocurrency exchange.
Binance estimated the financial impact of its security incident at approximately $6.3 billion, equivalent to around ₹59,982 crore based on the exchange's stated estimate and conversion in the supplied report.
The incident triggered sharp movements across cryptocurrency markets, with Bitcoin falling below the $78,000 level and Ether declining to a multi-month low.
According to Binance's preliminary investigation, the attack may have originated from a compromised laptop belonging to a DevOps engineer.
The attackers allegedly used the access gained through the device to enter a service container and submit unauthorised withdrawal transactions.
The exchange has been working with industry partners to trace and freeze affected assets.
The incidents involving Polymarket and Binance underline the growing cybersecurity challenges facing cryptocurrency exchanges and digital asset platforms.
While blockchain technology provides transparent transaction records, vulnerabilities in external software, user interfaces and internal infrastructure can still expose platforms to attacks.
The Polymarket incident particularly highlights the importance of securing third-party integrations, monitoring external code and strengthening transaction verification systems.
As cryptocurrency adoption continues to expand, exchanges and trading platforms will need stronger security arrangements, regular vulnerability assessments and effective emergency response mechanisms to protect user funds.
Conclusion
The $2.6 million Polymarket security breach highlights how compromised third-party software can create serious risks for cryptocurrency users. Although the platform restored operations and promised full refunds, the incident, alongside Binance's separate security breach, reinforces the need for stronger cybersecurity measures across the digital asset industry.