Polymarket Trading Halt After $2.65M Exploit: What Users Need to Know

On October 29, 2026, users logging into their Polymarket accounts found funds missing. The platform suspended trading after confirming a third-party provider breach, then resumed in a restricted cancel-only mode. Loss estimates vary between $1.4 million and $2.65 million across five independent news sources. The compromised provider's identity has not been disclosed, and no compensation plan has been announced. This article synthesizes the confirmed developments, identifies affected participants, and separates verified facts from details that still require a source-document check.

The Confirmed Polymarket Developments Across Five Sources

According to CoinDesk, Polymarket suspended trading after a third-party provider was breached, with users reporting drained accounts. Cointelegraph confirmed the platform halted trading on Thursday after reporting one of its third-party providers had been compromised. Decrypt added that Polymarket restricted trading and paused relayer actions as users reported funds leaving their accounts. A suspected attacker wallet holds about $2.65 million in POL, per Arkham data.

The Block reported that after over $2.5 million was lost within minutes, the platform placed its exchange in cancel-only mode. BeInCrypto noted that Polymarket froze new trades as users reported $1.4 million drained. The shared change across all sources is a third-party provider breach that forced an immediate trading halt, followed by a resumption under restricted conditions.

Checklist of confirmed facts: Polymarket suspended trading on October 29, 2026. A third-party provider was compromised. Users reported account drains. Trading resumed in cancel-only mode. The attacker wallet holds approximately $2.65 million in POL.

Who Is Affected and the Shared Operating Impact

The primary affected participants are Polymarket users who held funds on the platform, particularly those whose accounts were drained. The attacker wallet, holding approximately $2.65 million in POL, indicates the scale of the exploit. The platform itself is affected operationally, having to suspend and then resume trading under restricted conditions. The shared operating impact is that trading is now limited to cancel-only mode, meaning users can cancel existing orders but cannot place new ones.

This restricts liquidity and halts new market participation until the platform fully resolves the incident. According to The Block, the platform confirmed this operational constraint.

Checklist of affected parties and operational constraints: Polymarket users with drained accounts. The platform's trading operations limited to cancel-only mode. Liquidity restricted for all market participants. No new trades can be placed until the platform lifts the restriction.

What Remains Unconfirmed and the Next Source-Document Check

Several critical details remain unconfirmed. First, the exact identity of the compromised third-party provider has not been disclosed by Polymarket. Second, the total amount of user losses varies across sources: BeInCrypto reports $1.4 million drained, while Decrypt and The Block cite $2.65 million. The discrepancy needs reconciliation against official platform statements. Third, it is unclear whether affected users will be reimbursed. BeInCrypto explicitly asks, "What is confirmed, and who covers the losses?" As of now, no source confirms a compensation plan.

The next source-document check should focus on Polymarket's official post-incident report, which should clarify the provider's identity, the exact loss figure, and any remediation steps. Until then, users should treat the loss amount as an open question.

Checklist of unresolved items: Identity of the compromised third-party provider. Exact total of user losses (discrepancy between $1.4M and $2.65M). Whether affected users will be reimbursed. Official Polymarket post-incident report.

Polymarket's quick response, halting trading and moving to cancel-only mode, limited further damage, but the incident highlights the risks inherent in relying on third-party providers for custody or transaction processing. Users should monitor official Polymarket channels for updates on the investigation and any compensation process. The next check is Polymarket's own disclosure of the breached provider and the final loss tally.

Reference

• https://www.coindesk.com/markets/2026/10/29/polymarket-suspends-trading-after-third-party-breach-leads-to-user-losses
• https://cointelegraph.com/news/polymarket-suspends-trading-user-funds-compromised
• https://decrypt.co/382185/polymarket-pauses-trading-prediction-market-security-incident
• https://www.theblock.co/news/defi/2026-10-29-polymarket-exploit-2-5-million-cancel-only-mode-432158
• https://beincrypto.com/polymarket-halts-trading-users-drained