Hackers Drain $2.73M from 737 Polymarket Accounts in One Hour

A coordinated attack on Polymarket drained approximately $2.73 million from 737 user accounts within a single hour on October 29, according to a new blockchain investigation that traced nearly 1,000 unauthorized withdrawals through the prediction market's own infrastructure.

The Bitquery investigation found that attackers executed 985 withdrawals between 17:10 and 18:10 UTC, using valid wallet approvals rather than exploiting a smart-contract vulnerability. The funds were converted into Polygon's POL token and distributed across multiple wallets before some were moved toward Ethereum.

Bitquery identified a series of automated withdrawals routed through Polymarket's official transaction relayer, which submits user-authorized blockchain transactions without requiring traders to pay network fees directly.

The approvals appeared legitimate to the underlying smart wallets. In a sample of 30 withdrawals, researchers found that transactions were executed just three to seven seconds after their approvals were generated, suggesting automated activity.

The largest individual account loss reached approximately $358,000, while four accounts represented 43% of the total stolen funds. Meanwhile, 276 accounts lost less than $100 each.

The attack resembles a June security breach that resulted in approximately $2.94 million in losses across at least 11 wallets. That incident also involved malicious code introduced through a compromised third-party dependency.

Polymarket previously experienced account breaches linked to an external authentication provider, illustrating how services connected to a platform can become targets even when its underlying blockchain contracts remain intact.

Researchers identified an attacker-controlled address that received approximately 28.64 million POL before the tokens were distributed across three newly created wallets.

Some funds subsequently moved toward Ethereum through Relay, deBridge and Polygon's native bridge. At the investigation's 19:49 UTC cutoff, approximately $2.17 million remained in three Polygon wallets, while another identified Ethereum wallet held 126.10 ETH.

The attacker also transferred prediction-market positions from 33 accounts and created a new Polymarket account to sell some of the stolen shares.

One unusual finding concerned Polymarket's response. Bitquery identified another $10.99 withdrawal at 19:11 UTC, approximately 38 minutes after the company said it had fixed the problem.

That transaction does not establish that the vulnerability remained generally exploitable, but it raises questions about the timing of the remediation.

Polymarket's official incident report confirmed that an attacker replaced a third-party website script with malicious code targeting users who had the platform open.

The company removed the script, cleared caches, reset active sessions and temporarily suspended trading. It subsequently reported that 95% of affected wallets had been fully refunded and that total reimbursements would reach $3.9 million.

The breach adds another security concern for a prediction-market sector already facing scrutiny over market integrity and the handling of sensitive trading information.

It also illustrates a wider risk for decentralized financial applications: even when blockchain contracts function correctly, compromised external software can still authorize damaging transactions. Previous security concerns surrounding Polymarket have highlighted how important it is to distinguish genuine infrastructure compromises from other reported threats.