Polymarket has resumed trading on its flagship international platform following a security breach that drained funds from the digital wallets of several traders. The incident was not caused by a direct attack on the prediction market's website but rather stemmed from a compromise of a third-party vendor based in the United Kingdom. The company confirmed that UK law enforcement authorities have been notified of the event, and trading was paused for several hours to allow for an internal investigation.
Reports indicate that approximately 700 users were affected by the breach, with blockchain analytics firm Bubblemaps estimating the total stolen amount at around $2.7 million. While prominent traders took to social media platform X to report their financial losses, Polymarket declined to provide official figures regarding the number of impacted individuals or the exact sum lost when approached by WIRED. However, the company has stated its intention to refund all traders affected by the incident.
The security breach did not impact users on Polymarket US, the platform's newer service designed for residents within the United States. The company operates two distinct prediction markets: Polymarket US functions as a federally regulated financial exchange, whereas the flagship international version is a cryptocurrency-based platform that remains banned in the US and several other nations. This event marks a recurrence of similar vulnerabilities, as StartupFortune reported that an almost identical vendor-compromise attack occurred in June, which drained nearly $3 million from at least 11 user wallets via an injected frontend script.
The incident unfolded shortly after a separate major security event in the cryptocurrency sector, where more than $2 billion was drained from Binance wallets within a span of 40 minutes just hours before Polymarket suspended its trading operations.
Sources: Slashdot.