{"id":"CMP-202610-polymarket-breached-through-an-unnamed-third-party-provider-","kind":"campaign","aliases":[],"related":[],"title":"Polymarket breached through an unnamed third-party provider: international users' wallets drained (about $2.7M), trading halted","description":null,"summary":"On 29 Oct 2026 users of Polymarket's international platform (Polymarket.com) reported funds withdrawn without approval. Polymarket confirmed that one of its third-party providers was compromised, halted trading for about an hour, says the issue is fixed, and says affected users will be fully reimbursed. Losses are about $2.65-2.7M (Arkham, DeFi Llama). The US platform reportedly was not affected. Which provider was hit, how the attackers got in, and whether that provider's other customers are exposed are all unknown. This is Polymarket's second third-party breach this year; a front-end vendor breach in June 2026 cost users about $3M.","severity":"medium","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-10-29T19:49:26+00:00","products":[{"name":"Polymarket","fixed":[],"affected":"international platform (Polymarket.com), 29 Oct 2026","ecosystem":"saas"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"If you hold funds on Polymarket.com, look for withdrawals or transactions you did not approve on 29 Oct 2026. Specific indicators (the provider, addresses, domains) are unknown.","fix":"Check Polymarket balances and claim reimbursement for unauthorized withdrawals. Revoke wallet token approvals given to Polymarket-related contracts you don't use. Watch for Polymarket naming the compromised provider, and check whether you use that provider too.","status":"open","published_at":"2026-10-29T00:00:00+00:00","first_seen_at":"2026-10-29T19:49:26+00:00","triaged_at":"2026-10-29T19:49:26+00:00","updated_at":"2026-10-29T19:49:26+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-2.7':86B '-202610':20A '2.65':85B '2.7':15A '2026':38B,138B '29':36B '3m':142B 'affect':76B,97B 'an':25A 'approv':50B 'arkham':88B 'attack':104B 'breach':2A,127B,135B 'breached':23A 'campaign':31B 'cmp':19A 'compromis':62B 'confirm':52B 'cost':139B 'custom':113B 'defi':89B 'drain':13A 'earli':33B 'early-warn':32B 'end':133B 'expos':115B 'fix':73B 'front':132B 'front-end':131B 'fulli':80B 'fund':47B 'got':105B 'halt':18A,63B 'hit':101B 'hour':68B 'intern':10A,43B 'issu':71B 'june':137B 'llama':90B 'loss':82B 'm':16A,87B 'oct':37B 'one':54B 'parti':8A,59B,126B 'party':28A 'platform':44B,93B 'polymarket':1A,22A,30A,41B,51B,121B 'polymarket-breached-through-an-unnamed-third-party-provider':21A 'polymarket.com':45B 'provid':9A,60B,99B,110B 'provider':29A 'reimburs':81B 'report':46B,94B 'say':69B,75B 'second':123B 'third':7A,27A,58B,125B 'third-parti':6A,57B,124B 'through':24A 'trade':17A,64B 'unknown':118B 'unnam':5A 'unnamed':26A 'us':92B 'user':11A,39B,77B,140B 'vendor':134B 'wallet':12A 'warn':34B 'whether':108B 'withdrawn':48B 'without':49B 'year':129B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-29T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-polymarket-breached-through-an-unnamed-third-party-provider-","url":null,"severity":null,"published_at":"2026-10-29T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-29T19:49:26+00:00","fetched_at":"2026-10-29T19:49:26+00:00","note":null}],"documents":[{"id":18760,"url":"https://news.ycombinator.com/item?id=50294287","title":"Polymarket suspends trading after third-party breach leads to user losses","kind":"post","source":"hackernews","publisher":null,"text":"Polymarket suspends trading after third-party breach leads to user losses\nhttps://www.coindesk.com/markets/2026/10/29/polymarket-suspends-trading-after-third-party-breach-leads-to-user-losses\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-29T19:10:37+00:00","relation":"describes","confidence":null,"note":null},{"id":18916,"url":"https://news.ycombinator.com/item?id=50294463","title":"Polymarket halts trading after compromise, impacted users will be 'made whole'","kind":"post","source":"hackernews","publisher":null,"text":"Polymarket halts trading after compromise, impacted users will be 'made whole'\nhttps://www.nbcnews.com/business/consumer/polymarket-trading-halt-hack-wallets-rcna606405\n\n3 points, 0 comments on Hacker News","published_at":"2026-10-29T19:23:50+00:00","relation":"describes","confidence":null,"note":null},{"id":18943,"url":"https://www.coindesk.com/markets/2026/10/29/polymarket-suspends-trading-after-third-party-breach-leads-to-user-losses","title":"Polymarket suspends trading after third-party breach leads to user losses","kind":"other","source":"analyst","publisher":null,"text":"Polymarket suspended trading on its international platform (Polymarket.com) on 29 Oct 2026 after a third-party provider was compromised; users reported accounts drained. Polymarket: 'One of our third party providers was compromised, and we have referred this to relevant law enforcement.' Users to be made whole. ~$2.7M losses (DeFi Llama); ~$2.65M per Arkham via The Block. US platform reportedly unaffected. Trading resumed after about an hour (NBC). Second third-party breach after a June 2026 front-end vendor breach (~$3M).","published_at":"2026-10-29T00:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":19091,"url":"https://x.com/vxunderground/status/2115898090636951776","title":"@vxunderground: Polymarket was compromised by an unknown Threat Actor. Over 1,000,000 users have","kind":"post","source":"x","publisher":null,"text":"Polymarket was compromised by an unknown Threat Actor. Over 1,000,000 users have been cryptodrained in the past hour.\n\nThrowback to when Polymarket mocked Threat Actors for enumerating their infrastructure and building targets. https://t.co/WgBNpthgHz\n\nlikes 1027 reposts 116","published_at":"2026-10-29T20:06:30+00:00","relation":"discussion","confidence":null,"note":null},{"id":19245,"url":"https://x.com/vxunderground/status/2115906655548268724","title":"@vxunderground: Polymarket was compromised by an unknown Threat Actor. Millions of dollars have ","kind":"post","source":"x","publisher":null,"text":"Polymarket was compromised by an unknown Threat Actor. Millions of dollars have been stolen in the past hour.\n\nThrowback to when Polymarket mocked Threat Actors for enumerating their infrastructure and building targets. https://t.co/F9CaDUeZuf\n\nlikes 1392 reposts 151","published_at":"2026-10-29T20:40:32+00:00","relation":"discussion","confidence":null,"note":null},{"id":19251,"url":"https://x.com/vxunderground/status/2115907829022269934","title":"@vxunderground: Updated this post. I initially wrote \"millions of users have been drained in the","kind":"post","source":"x","publisher":null,"text":"Updated this post. I initially wrote \"millions of users have been drained in the past hour\", but I have a small brain, I meant to say \"Millions of dollars have been drained in the past hour\".\n\nI edited the post with better language, sorry to anyone I confused\n\nlikes 158 reposts 1","published_at":"2026-10-29T20:45:12+00:00","relation":"discussion","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}