Polymarket Hack Drains $2.73 Million From 737 Wallets in One Hour
A security breach targeting Polymarket drained approximately $2.73 million from 737 user accounts within one hour on October 29, according to a blockchain investigation by Bitquery. The attackers carried out 985 unauthorized withdrawals using the platform's transaction infrastructure, with investigators finding that valid wallet approvals enabled the transfers rather than a direct exploit of Polymarket's smart contracts.
The investigation traced the withdrawals to activity between 17:10 and 18:10 UTC. The stolen funds were converted into Polygon's POL token and distributed across multiple wallets, with some subsequently transferred toward Ethereum. Polymarket later reported that it had reimbursed 95% of affected wallets and that total refunds and compensation would reach $3.9 million.
How the Polymarket Security Breach Worked
Bitquery's investigation identified automated withdrawals processed through Polymarket's official transaction relayer. The service submits blockchain transactions authorized by users, allowing traders to interact with the platform without paying network fees directly for each transaction.
Researchers found that the wallet approvals used in the withdrawals appeared valid to the underlying smart wallets. In a sample of 30 transactions, the time between approval generation and execution was just three to seven seconds, a pattern consistent with automated activity.
The losses varied considerably across affected accounts. The largest individual loss was approximately $358,000, while four accounts together accounted for 43% of the stolen funds. By comparison, 276 accounts lost less than $100 each.
The incident follows an earlier security breach in June that caused approximately $2.94 million in losses across at least 11 wallets. That attack also involved malicious code introduced through a compromised third-party dependency, highlighting the potential risks associated with software components connected to a platform.
Polymarket had previously faced account breaches linked to an external authentication provider. These incidents illustrate how weaknesses in connected services can expose users to financial losses even when the platform's underlying blockchain contracts are not directly compromised.
Bitquery Tracks Stolen POL Tokens Across Multiple Wallets
Investigators identified an address controlled by the attacker that received approximately 28.64 million POL tokens. The assets were subsequently distributed among three newly created wallets, according to Bitquery's findings.
Some of the funds were later moved toward Ethereum through Relay, deBridge and Polygon's native bridge. At the investigation's cutoff time of 19:49 UTC, approximately $2.17 million remained in three Polygon wallets. Another identified wallet on Ethereum held 126.10 ETH.
The investigation also found that the attacker transferred prediction-market positions from 33 accounts and created a new Polymarket account to sell some of the stolen shares. These activities extended the incident beyond the unauthorized withdrawal of funds to the handling of users' existing market positions.
Another transaction raised questions about the timing of Polymarket's response. Bitquery identified a further $10.99 withdrawal at 19:11 UTC, approximately 38 minutes after the company said it had fixed the problem.
The additional transaction does not prove that the same vulnerability remained broadly exploitable after the reported fix. However, its timing leaves open questions about when the remediation took effect and whether all related risks had been addressed.
Polymarket Reports $3.9 Million in Refunds and Compensation
In its official incident report, Polymarket said an attacker had replaced a third-party website script with malicious code designed to target users who had the platform open. The explanation points to a compromise involving external website code rather than a direct failure of the platform's smart contracts.
Polymarket said it removed the malicious script, cleared caches, reset active sessions and temporarily suspended trading as part of its response. The company subsequently reported that 95% of affected wallets had been fully refunded, with total reimbursements expected to reach $3.9 million.
The announced reimbursement total exceeds the approximately $2.73 million in losses identified by Bitquery. The incident report, as summarized in the available information, does not provide a detailed breakdown explaining the difference between the traced losses and the total compensation figure.
Third-Party Software Remains a Security Risk for Crypto Platforms
The Polymarket breach highlights a security challenge for decentralized financial applications and other blockchain-based services: functioning smart contracts do not necessarily protect users from malicious software operating elsewhere in the application stack.
In this case, the reported attack involved a compromised website script and wallet approvals that enabled unauthorized transactions. The findings demonstrate why security assessments must consider not only blockchain contracts but also website dependencies, transaction authorization processes and the services used to interact with blockchain networks.
The incident also adds to broader concerns about security and market integrity in the prediction-market sector. While Polymarket's reported remediation and reimbursement measures address part of the immediate impact, the investigation's findings leave important questions about the attack's execution, the movement of stolen assets and the timing of the platform's response.
source: coinpaper
Writer: Ethan Collins
Crypto Journalist
Ethan Collins reports on developments across the cryptocurrency and blockchain sector. His work covers market movements, protocol updates, regulatory changes, and emerging trends in digital assets.
He focuses on presenting complex topics in a clear and accessible manner for a broad readership.
Check out other news and articles on Google News
Disclaimer:
The articles on Hokanews are here to keep you updated on the latest buzz in crypto, tech, and beyond—but they’re not financial advice. We’re sharing info, trends, and insights, not telling you to buy, sell, or invest. Always do your own homework before making any money moves.
Hokanews isn’t responsible for any losses, gains, or chaos that might happen if you act on what you read here. Investment decisions should come from your own research—and, ideally, guidance from a qualified financial advisor. Remember: crypto and tech move fast, info changes in a blink, and while we aim for accuracy, we can’t promise it’s 100% complete or up-to-date.