Polymarket Halts Trading After Provider Compromise

Polymarket froze trading on its international exchange on Thursday 29 October, saying one of its third-party providers had been compromised and that it had referred the matter to law enforcement. The company said “anyone who has been impacted will be made whole”.

The first sign of trouble came at 18:05 GMT, when Polymarket’s status page said the exchange was “currently in cancel-only mode and relayer actions paused while we investigate an incident”. In cancel-only mode, users can withdraw orders already on the book but cannot place new ones. Thirty-two minutes later the company gave a cause, though not a name: “One of our third party providers was compromised.” It has not identified the provider, said how many accounts were affected or put a figure on any losses.

The same statement went out on X from Polymarket’s traders account, @PolymarketTrade, which carries X’s affiliation badge for Polymarket. Neither the main @Polymarket account nor chief executive Shayne Coplan had posted about the incident by the time of writing.

Trading set to restart about an hour after the freeze

At 18:55 GMT the status page moved the incident to “Monitoring” and said: “Trading will resume at approximately 3pm ET.” That is 19:00 GMT. A minute earlier the traders account had posted: “We are coming back online.”

The outage was confined to one part of the business. The status page listed the Predictions Trading API, the central limit order book that matches buy and sell orders, as a “major outage”. The web app, account access and authentication, on-chain settlement and the Perpetuals products were all shown as operational.

The pause on relayer actions matters for how users move money. According to Polymarket’s developer documentation, its relayer handles “gasless wallet operations” for accounts, meaning certain wallet transactions are submitted on users’ behalf so they need not pay network fees themselves. Pausing it halts those operations while the incident is investigated.

The statement refers specifically to “our international platform, Polymarket.com”. Polymarket runs a separate platform for US customers, and its geographic restrictions page lists both the United States and the United Kingdom as close-only jurisdictions on the international site, where “users can close existing positions but cannot open new ones”. That suggests users connecting from the UK were already unable to open new positions on Polymarket.com, though anyone with existing positions there would still have been caught by the freeze.

Users raised the alarm before the company did

Reports of drained accounts were circulating on X about 20 minutes before the first status update, BeInCrypto reported, and one trader urged others to lock down their accounts. TSN has not verified any of the amounts claimed in those posts, and Polymarket has not confirmed a loss total. The Defiant and Cointelegraph also covered the halt.

The freeze comes at a busy moment for the platform. This week the NBA named Polymarket and Kalshi as its preferred prediction market exchanges, and the regulatory fight over event contracts in the US has kept widening, with the CFTC now suing Utah over its case against Kalshi. TSN’s earlier look at the rivalry between Kalshi and Polymarket set out how the two platforms grew under very different rules.

A vendor breach turns Polymarket’s promise into the test

Polymarket’s statement does three things quickly: it names the type of failure, it pulls in law enforcement, and it promises compensation. What it leaves open is the part regulators and users care about most. “Made whole” has no amount, no timetable and no stated method attached, and without a named provider, other platforms cannot easily tell whether they share the same exposure.

Third-party risk keeps recurring in the crypto incidents TSN has covered, from Solflare’s staking provider key problem to cases where outside code sits between a user and an exchange. A platform can keep its own contracts and servers locked down and still be exposed through a supplier it relies on. For a compliance team, that is a vendor-management question as much as a security one: who has access to what, how quickly a supplier’s compromise is detected, and who pays when it happens.

The timeline also shows how a status page and the evidence users see can drift apart. Users were reporting problems on X about 20 minutes before Polymarket’s first notice, and the company named a cause roughly 50 minutes after those first reports. For a market whose product is real-time information, that gap is worth noticing.

The next marker is the restart. If trading resumes at 19:00 GMT as promised, attention will turn to whether Polymarket names the provider, publishes a loss figure and explains how and when affected users will be repaid.