Polymarket suspected of frontend attack, trading switched to cancel-only mode

On October 30, according to Decrypt, the prediction market Polymarket is suspected of having suffered a security incident. Trading has been switched to cancel-only mode (users can only cancel existing orders and cannot place new orders), and relayer operations have also been suspended. Multiple users reported unauthorized transfers of account assets, with one trader claiming losses of approximately $800,000.

Arkham data shows that an address flagged as a suspected attacker has exchanged multiple USDC.e holdings for POL via Relay and currently holds approximately $2.65 million worth of POL. Security firm Hudson Rock reported that a script hosted on the website performance monitoring service DebugBear contained code to drain wallet assets, with the same address hardcoded as a backup receiving address; the cause of the incident and the number of affected users remain unclear.

Polymarket has not yet clarified the cause of the incident. TechFlow reminds users to temporarily suspend interactions with the website until official confirmation is released.