Polymarket Reportedly Hacked as Users Report Funds Stolen From Crypto Wallets

Polymarket’s international platform temporarily suspended trading after a third-party provider was compromised, leading to reports of unauthorized withdrawals and missing account balances.

The Polymarket Traders account later announced that trading had resumed and promised to reimburse affected traders fully.

In its public incident statement, the account said it had identified and fixed the issue affecting Polymarket.com and referred it to relevant law enforcement. However, the disclosure did not identify the compromised provider or explain how attackers accessed funds.

“Anyone who has been impacted will be made whole,” the statement said, adding that trading was temporarily halted “out of an abundance of caution.”

Polymarket Reportedly Hacked

User responses to the restoration announcement included complaints about depleted balances. One trader reported that their account showed zero funds and that they had noticed an unauthorized withdrawal. Another said the platform was back online, but their money was not. These remain individual reports rather than independently verified loss assessments.

The account initially announced that trading would resume at approximately 3 p.m. ET, then confirmed full restoration in a subsequent update.

“We’ll make this right and are fully reimbursing all affected traders,” the follow-up statement said. It did not provide a reimbursement deadline, eligibility criteria, or a detailed claims process.

The confirmed involvement of an external provider makes third-party security central to the investigation. Nevertheless, the available disclosure does not establish whether attackers compromised authentication infrastructure, wallet services, application code, or another integration.

Separate investigations into Web3 supply-chain attacks targeting wallet operators have documented malicious dependencies harvesting private keys and recovery phrases. These illustrate distinct attack mechanisms, not evidence of how this incident occurred.

The reviewed statements contained no exploit chain, malicious wallet addresses, transaction hashes, indicators of compromise, or affected-user count. Consequently, attributing the incident to a particular threat actor or describing it as a confirmed smart-contract exploit would exceed the available evidence.

The restoration announcement says the immediate operational disruption has ended. However, reimbursement remains a commitment rather than a publicly documented, completed process.

The unresolved questions include the provider’s identity, the scope of unauthorized access, total losses, and whether exposed credentials or wallet permissions require further remediation. Until additional findings emerge, those technical boundaries remain unclear.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.