Signal Snapshot
- Polymarket paused trading after reports of stolen funds. This is a security event.
- Polymarket put its exchange in cancel-only mode and paused relayer actions.
- Users say funds left accounts without approval. One trader reports a loss of about $800,000.
- A wallet tied to the scare holds about $2.65 million in POL. That figure comes from Arkham data.
- Top risk is clear. Do not use the site until Polymarket says it is safe.
Key Takeaways
- Polymarket paused new orders and relayer actions after users reported funds leaving without approval.
- Cancel-only mode lets traders pull old orders. It blocks all new orders until the issue is fixed.
- The real read is trust. Prediction markets need safe accounts. Safety must come before trading.
What Happened
Polymarket stopped normal trading on Oct. 29. The team moved fast after user reports spread. The move puts safety first. It also freezes price action for all users.
The exchange is now in cancel-only mode. That means traders can pull old orders. They cannot place new ones. The trading API shows a major outage. The exchange pause and outage update lays out the current status.
Relayer actions are also paused. Relayers send signed user trades to the chain. With relayers paused, no new on-chain actions go through. This stops more harm. It also stops normal use.
Users say the front end may be hacked. They report funds leaving without approval. One trader says he lost about $800,000. He warns others to lock down accounts. He says a friend lost about $600,000. He tells users not to touch the site.
The scare centers on one wallet. That wallet holds about $2.65 million in POL. Arkham data flags the balance. The funds came after many swaps from USDC.e to POL through Relay. Swaps do not prove guilt. They show where funds moved.
A security firm adds more detail. Hudson Rock points to a hosted script. The script lived on DebugBear. The firm says the script held wallet-draining code. The code names the same wallet as a fallback. Fallback means spare address for stolen funds. That link raised alarms fast.
Polymarket has not shared a full post-mortem yet. The report on the drained accounts notes the user claims and the paused systems. Users now wait for a fix. They also wait for clear steps to stay safe.
Why It Matters
This is a security event. It is also a market-structure shift. Trading is halted. Price discovery is halted too. Users cannot express views on news. That is the core job of a prediction market.
Cancel-only mode matters for risk. It lets users cut risk. It stops users from adding risk. Open orders can be pulled. New bets cannot be placed. That is painful. It is safer than leaving the book open.
The relayer pause matters more. Relayers move user intent to settlement. They take a signed order. They post it on-chain. When relayers stop, settlement stops. Funds stay put. Attack paths also narrow. This buys time for review.
Front-end risk is hard for most users to see. The site can look normal. The code behind it can act bad. Users sign what they trust. A bad script can swap the target. Funds then leave without clear warning. That is why traders fear this type of bug.
Trust is the product here. Prediction markets run on clear rules. Users must trust accounts. They must trust balances. They must trust payouts. One drain report hurts trust. Many reports hurt it more. High-profile losses speed the fear.
The wallet detail shapes the next read. About $2.65 million in POL sits in one flagged address. That size gets attention. It does not set total losses. Total losses are still open. More reports could lift the sum. A fix could cap it.
The script detail also matters. Hudson Rock ties the same address to draining code. That is a strong signal. It is not final proof. Code can be copied. Addresses can be reused. Still, the match is hard to ignore. Token Metrics readers should treat it as a lead, not a verdict.
For crypto rails, this touches exchanges and settlement. Polymarket is an exchange for event bets. It relies on fast settlement. A pause breaks both rails at once. Users feel it in frozen markets. Builders feel it in paused flows. The fix must cover both layers.
Second-order effects will show in behavior. Users may pull funds after reopening. Market makers may widen spreads. Big traders may wait. New users may pause sign-ups. Each step slows activity. Slow activity can last after the fix.
Market Context
This story fits as a security event. It also fits as an exchange story. Liquidity is frozen by design. Adoption pauses during fear. Sentiment turns careful. Those tags fit better than macro or regulation.
Prediction markets live or die on account safety. Users keep balances on site. They sign trades often. They trust the front end each time. A draining bug breaks that loop. Even a short bug can leave long doubt.
Cancel-only mode is a known safety tool. Exchanges use it to cool stress. It keeps old orders open for cancel. It blocks new bids and offers. This limits chaos. It gives staff room to check systems. It is common in outages.
Relayer pauses are less seen by retail. They are vital in crypto. Many apps use relayers. Relayers pay gas. They batch actions. They post user trades. Pausing them halts the chain link. That is a blunt tool. Blunt tools help in fast scares.
No historical analogs were supplied for this brief. So we do not cite past hacks. We focus on what is seen now. An exchange halt. A relayer halt. User loss claims. A flagged wallet. A suspect script. That set alone supports care.
The timing adds pressure. Reports spread fast on social. One post cites about $800,000 lost. Another cites about $600,000 for a friend. Social speed can outrun facts. It can also warn users in time. Both effects are live now.
What would calm the market is simple. A clear cause. A fixed front end. A resumed relayer. A normal order book. Until then, care is the right stance. Noise will stay high. Facts will come slower.
Risks to Watch
The first risk is more drains. New reports would point to an active bug. Watch social posts with proof. Watch wallet outflows. One case is bad. Many cases mean wider harm.
The second risk is a wrong fix. A fast reopen can restart the drain. Users would sign again. Funds could move again. A rushed fix helps no one. A tested fix does.
The third risk is fake help. Scammers love big scares. They post fake support links. They push fake refunds. They ask for seed phrases. No real team asks for that. Clicking wrong links can drain more funds.
The fourth risk is frozen funds. Cancel-only can trap hedges. Users cannot add protection. They can only cut orders. Fast news events could move prices. Users would watch without tools.
What would make this matter less is also clear. If losses stay small, fear fades. If the script link proves wrong, the read shifts. If systems resume fast with no new drains, trust can rebuild. Each path needs proof, not posts.
What to Watch Next
- Watch the status page for a shift from cancel-only to normal trading. Normal means new orders are live again.
- Watch for a relayer resume notice. Relayers must move before full use returns.
- Watch for an official cause report from Polymarket. Look for what broke and what was fixed.
- Watch the flagged wallet for moves of the POL balance. Moves do not prove who owns it. They show if funds shift.
- Watch for user safety steps like session resets or approvals to revoke. Act only on official links.
- This article is for information only. It is not investment advice.
