Key points:
- Hackers stole $2.73 million from 737 Polymarket accounts.
- Valid wallet authorization allows funds to be withdrawn without compromising the smart contract.
- Polymarket announces it will issue refunds and compensation of $3.9 million
According to a new blockchain investigation, on October 29, a coordinated attack stole approximately $2.73 million from 737 user accounts, with funds transferred within one hour. The investigation found that the stolen funds passed through the prediction market’s own infrastructure.
Bitquery’s investigation found that the attacker executed 985 withdrawal transactions between 17:10 and 18:10 UTC using valid wallet authorizations, rather than exploiting a smart contract vulnerability. The funds were subsequently converted into Polygon’s POL token and dispersed across multiple wallets, after which a portion was transferred to Ethereum.
How hackers withdrew funds from 737 Polymarket accounts
Bitquery identified a series of automated withdrawals routed through Polymarket's official transaction relayer. The relayer submits blockchain transactions authorized by users, eliminating the need for traders to pay network fees directly.
These authorizations appear legitimate to the underlying smart wallet. In a sample of 30 withdrawals, researchers found that transactions were executed just 3 to 7 seconds after the authorization was generated, indicating automated activity.
The maximum loss for a single account was approximately $358,000, and these four accounts collectively accounted for 43% of the total stolen funds. Meanwhile, 276 accounts each lost less than $100.
This attack is similar to a security vulnerability in June, which resulted in approximately $2.94 million in combined losses across at least 11 wallets. The issue at that time also involved malicious code introduced through a compromised third-party dependency.
Polymarket has previously experienced account breaches related to external identity verification providers, demonstrating that even if the underlying blockchain contracts remain intact, services connected to the platform can still be targeted by attackers.
Investigators tracked the flow of stolen funds between Polygon and Ethereum.
Researchers identified an address controlled by the attacker that received approximately 28.64 million POL, after which the tokens were distributed to three newly created wallets.
A portion of the funds was subsequently transferred to Ethereum via Relay, deBridge, and Polygon’s native bridge. As of the investigation cutoff at 19:49 UTC, approximately $2.17 million remained in three Polygon wallets, and another identified Ethereum wallet held 126.10 ETH.
An unusual discovery relates to Polymarket’s response. Bitquery found another withdrawal of $10,990 at 19:11 UTC, approximately 38 minutes after the company claimed to have fixed the issue.
This transaction does not prove that the vulnerability is still generally exploitable, but it does raise questions about the timing of the fix.
Polymarket announces a $3.9 million payout
Polymarket's official incident report confirms that the attacker replaced a third-party website script and embedded malicious code targeting users who accessed the platform.
The company subsequently removed the script, cleared the cache, reset active sessions, and temporarily suspended trading. Polymarket later stated that 95% of affected wallets have received full refunds, with total compensation reaching $3.9 million.
This breach has added another security concern to the prediction market industry, which has already been under scrutiny for market integrity and the handling of sensitive transaction information.
It also highlights the broader risks faced by decentralized finance applications: even if the blockchain contract itself operates correctly, compromised external software may still authorize transactions that cause losses. Polymarket’s previous security issues also underscore the importance of distinguishing between actual infrastructure breaches and other reported threats.