On October 29, users on social media began flagging unauthorized withdrawals and suspicious signature prompts, and the prediction market responded by restricting trading to cancel-only mode and pausing relayer actions. Users can still pull existing orders, but no new ones can be placed.

The reports point to a possible frontend compromise rather than a smart-contract exploit. Losses are reportedly in the hundreds of thousands of dollars, though the figures remain unconfirmed and Polymarket has not yet published an official breakdown. Users were warned not to connect wallets or sign transactions until the situation is resolved.

This is at least the third security incident at Polymarket in 2026, after an internal POL wallet breach in May and a June supply-chain attack that drained about $3M in pUSD.

Polymarket runs on Polygon with non-custodial proxy wallets, so any fund movements tied to the drains can be traced on-chain. Key open questions are the confirmed size of losses and when full trading resumes.