Onchain analytics firm Bubblemaps said roughly $2.7 million was converted to POL and moved out of Polymarket following its Oct. 29 breach, which it estimated affected more than 700 users.
The prediction-market platform said an unnamed third-party provider had been compromised and that it had referred the incident to law enforcement. By about 3 p.m. ET, it said trading was fully back online and promised full reimbursement for affected traders.
Bubblemaps put the overall drain at $3.46 million, including $750,000 it attributed to trader Car and said remained in another Polymarket account. Car, however, said he had saved about $700,000 by sending it to a friend after spotting sell orders he had not placed.
“That money is now safe according to Polymarket,” Car wrote. His account raises uncertainty over how much of Bubblemaps' headline tally represents stolen rather than rescued money.
PolygonScan records show 750,000 units of Polymarket's pUSD token moved in three transactions from a wallet labeled as Car's to the deposit wallet Bubblemaps identified, according to The Defiant's tally. Those records show the movement but do not settle who controlled the receiving account.
The main wallet identified by Bubblemaps separately sent POL to three recipients, PolygonScan shows. One recipient forwarded funds to a fourth wallet that used a cross-chain bridge. On Ethereum, one of the six wallets listed in Bubblemaps' tracing received 19.32 ETH and sent it onward, Etherscan shows.
“Funds are still moving,” Bubblemaps wrote in its 3:27 p.m. ET report.
https://x.com/i/status/2115888329585750263
June's Vendor Breach
Bubblemaps estimated roughly $3 million in losses from fewer than 15 accounts in June, when Polymarket said a compromised vendor had injected malicious code into its website. The platform said it had removed the affected software dependency and would refund users, as The Defiant previously reported.
Polymarket's October incident updates did not give its own loss total or a timetable for reimbursements.