The prediction market paused new trades and relayer actions as unconfirmed reports of drained wallets and a compromised frontend spread on social media
Polymarket has put its trading floor on lockdown. On October 29, 2026, the prediction market restricted trading to cancel-only mode and paused relayer actions after unconfirmed reports of drained wallets and a possibly compromised frontend.
Cancel-only mode works the way it sounds. Users can pull existing orders, but nobody can place new ones.
Users were warned not to connect wallets or sign transactions while the situation develops.
What reportedly happened
Reports of unauthorized withdrawals and suspicious signature prompts began surfacing on social media. Several users described what looked like a frontend compromise, and reported losses were estimated in the hundreds of thousands.
Those figures come from user reports and remain unconfirmed. Polymarket has not issued an official statement on the incident.
A frontend compromise is different from a smart-contract hack. The frontend is the website you see and click on, while the smart contracts are the on-chain code that actually holds and moves funds. If attackers tamper with the website, they can show users malicious signature requests that look legitimate.
So far, there is no evidence pointing to a core smart-contract exploit in the latest incident. That distinction matters, because it suggests the damage may be tied to what users were tricked into approving rather than a flaw in the protocol’s underlying code.
The pause on relayer actions is also notable. Relayers are services that submit transactions on users’ behalf, often to smooth over gas fees and wallet friction. Freezing them cuts off one route an attacker could use to push transactions through at scale.
How Polymarket’s plumbing works
Polymarket runs on the Polygon network. Traders use non-custodial, Polygon-based proxy wallets, which means the platform doesn’t hold user funds directly.
Trading and settlement run through pUSD, a token backed 1:1 by USDC. Every bet placed and every payout collected moves through that token.
Market participants are now watching on-chain activity on Polygon closely. Because transactions there are public, any fund movements tied to the reported drains can, in principle, be traced in real time.
A pattern, not a one-off
This is not Polymarket’s first security scare of 2026. It’s at least the third.
In May 2026, an internal POL wallet was breached. Losses from that incident were estimated between $573,200 and $700,000.
A month later came a bigger blow. In June 2026, a supply-chain attack tied to a compromised third-party script drained approximately $3 million in pUSD from under 15 user wallets.
After those incidents, Polymarket’s operational measures included geographic restrictions and enhanced monitoring of third-party scripts. The latest reports, centered once again on the frontend, will raise questions about whether those safeguards went far enough.
What this means for users and the prediction market space
For anyone holding positions on Polymarket, the immediate guidance is simple. Don’t connect a wallet. Don’t sign anything. Wait for an official word from the platform.
The silence is also a factor. Users have been piecing together the situation from social media posts rather than from Polymarket itself.
There’s a meaningful difference between the outcomes on the table. If the incident is confirmed as a frontend-only compromise, the core protocol may come through intact, and the fix likely centers on the website and the scripts it loads.
What to watch next: an official statement from Polymarket, confirmation of the actual losses, any traced fund flows on Polygon, and details on how and when full trading resumes.
