Polymarket Suspected Front-End Attack; Trading Switched to Cancel-Only Mode

TechFlow reports that on October 30, according to Decrypt, prediction market Polymarket appears to have suffered a security incident. Trading has been switched to cancel-only mode (users can only cancel existing orders and cannot place new ones), and relayer operations have also been suspended. Multiple users reported that account assets were transferred out without authorization, and some traders said they lost approximately $800,000.

Arkham data shows that an address flagged as a suspected attacker has used Relay to swap multiple USDC.e transactions into POL and currently holds approximately $2,650,000 worth of POL. Security firm Hudson Rock said a script hosted on website performance monitoring service DebugBear contained code designed to steal wallet assets and hardcoded the same address as a backup receiving address; the cause of the incident and the number of affected users remain unclear.

Polymarket has not yet disclosed the cause of the incident. TechFlow advises affected users to refrain from interacting with the site until official confirmation.

Source: TechFlow