Polymarket halts offshore platform after third-party breach drains millions
Polymarket paused trading on its offshore international platform Thursday after hackers compromised a third-party provider and drained user funds. Losses traced to the attacker wallet totaled $2.65 million, according to Arkham data. The platform restricted trading to cancel-only mode, then suspended withdrawals entirely while investigating. Polymarket pledged that affected traders would be 'made whole.' Trading resumed after roughly an hour, NBC News reported. The incident did not involve Polymarket's core smart contracts, the company said.
The breach hit Polymarket's offshore platform, sparing the separate CFTC-regulated US venue operated through QCX LLC. Traders with funds on the international site faced frozen positions and uncertain recovery timing while Polymarket investigated. The incident exposed third-party data providers as a critical vulnerability even for platforms with audited smart contracts.
Competitors like Kalshi and ForecastEx can now point to concrete losses when arguing that regulated custody infrastructure offers stronger protection. Polymarket's reimbursement promise will test its treasury and set a benchmark rivals will be measured against in future breaches. Trust damage from the offshore site bleeds into the regulated US venue too. The shared Polymarket brand means security failures on either platform hurt both.
Becomes the second major prediction-market security incident in two days, after Predict .fun's $400K exploit, exposing third-party infrastructure as a systemic weakness across crypto-native venues.