Live › campaign › CMP-202610-polymarket-breached-through-an-unnamed-third-party-provider-
On 29 Oct 2026 users of Polymarket's international platform (Polymarket.com) reported funds withdrawn without approval. Polymarket confirmed that one of its third-party providers was compromised, halted trading for about an hour, says the issue is fixed, and says affected users will be fully reimbursed. Losses are about $2.65-2.7M (Arkham, DeFi Llama). The US platform reportedly was not affected. Which provider was hit, how the attackers got in, and whether that provider's other customers are exposed are all unknown. This is Polymarket's second third-party breach this year; a front-end vendor breach in June 2026 cost users about $3M.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 19:49 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Polymarket | saas | international platform (Polymarket.com), 29 Oct 2026 | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
@vxunderground · X1026 likes · 118 reposts2026-10-29 20:06“Polymarket was compromised by an unknown Threat Actor. Over 1,000,000 users have been cryptodrained in the past hour. Throwback to when Polymarket mocked Threat Actors for enumerating their infrastructure and building targets. https://t.co/WgBNpthgHz”
View on X
@vxunderground · X685 likes · 84 reposts2026-10-29 20:40“Polymarket was compromised by an unknown Threat Actor. Millions of dollars have been stolen in the past hour. Throwback to when Polymarket mocked Threat Actors for enumerating their infrastructure and building targets. https://t.co/F9CaDUeZuf”
View on X
@vxunderground · X85 likes · 1 reposts2026-10-29 20:45“Updated this post. I initially wrote "millions of users have been drained in the past hour", but I have a small brain, I meant to say "Millions of dollars have been drained in the past hour". I edited the post with better language, sorry to anyone I confused”
View on X
Posts are quoted with a link to the original. They are data to us, never instructions.
This page as .md · .json · in your agent: get_signal("CMP-202610-polymarket-breached-through-an-unnamed-third-party-provider-")