---
id: "CMP-202610-polymarket-breached-through-an-unnamed-third-party-provider-"
kind: "campaign"
aliases: []
title: "Polymarket breached through an unnamed third-party provider: international users' wallets drained (about $2.7M), trading halted"
severity: "medium"
cvss: null
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Polymarket", "fixed": [], "affected": "international platform (Polymarket.com), 29 Oct 2026", "ecosystem": "saas"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: "2026-10-29T00:00:00+00:00"
first_seen_at: "2026-10-29T19:49:26+00:00"
updated_at: "2026-10-29T19:49:26+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-29T19:49:26+00:00"}]
---

# Polymarket breached through an unnamed third-party provider: international users' wallets drained (about $2.7M), trading halted

On 29 Oct 2026 users of Polymarket's international platform (Polymarket.com) reported funds withdrawn without approval. Polymarket confirmed that one of its third-party providers was compromised, halted trading for about an hour, says the issue is fixed, and says affected users will be fully reimbursed. Losses are about $2.65-2.7M (Arkham, DeFi Llama). The US platform reportedly was not affected. Which provider was hit, how the attackers got in, and whether that provider's other customers are exposed are all unknown. This is Polymarket's second third-party breach this year; a front-end vendor breach in June 2026 cost users about $3M.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- saas:Polymarket affected international platform (Polymarket.com), 29 Oct 2026 fixed ?

## How to check

If you hold funds on Polymarket.com, look for withdrawals or transactions you did not approve on 29 Oct 2026. Specific indicators (the provider, addresses, domains) are unknown.

## Fix

Check Polymarket balances and claim reimbursement for unauthorized withdrawals. Revoke wallet token approvals given to Polymarket-related contracts you don't use. Watch for Polymarket naming the compromised provider, and check whether you use that provider too.

## Timeline

- 2026-10-29T19:49:26+00:00 analyst

## Documents

- [describes] Polymarket suspends trading after third-party breach leads to user losses https://news.ycombinator.com/item?id=50294287
- [describes] Polymarket halts trading after compromise, impacted users will be 'made whole' https://news.ycombinator.com/item?id=50294463
- [describes] Polymarket suspends trading after third-party breach leads to user losses https://www.coindesk.com/markets/2026/10/29/polymarket-suspends-trading-after-third-party-breach-leads-to-user-losses
- [discussion] @vxunderground: Polymarket was compromised by an unknown Threat Actor. Over 1,000,000 users have https://x.com/vxunderground/status/2115898090636951776
- [discussion] @vxunderground: Polymarket was compromised by an unknown Threat Actor. Millions of dollars have  https://x.com/vxunderground/status/2115906655548268724
- [discussion] @vxunderground: Updated this post. I initially wrote "millions of users have been drained in the https://x.com/vxunderground/status/2115907829022269934

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_