Polymarket stopped new trades on Thursday after users reported that money had disappeared from their accounts. The prediction market later said an outside service provider had been compromised, promised to reimburse affected users and said it had referred the matter to law enforcement.
The $2.68 million figure cited on social media is an unverified estimate, not a confirmed loss total. Polymarket said it had fixed the problem on its international platform, Polymarket.com, but did not disclose an overall amount or affected account count.
One of our third party providers was compromised, and we have referred this to relevant law enforcement. Anyone who has been impacted will be made whole.
That promise appeared in the company's official notice, following its initial warning that the exchange had moved into cancel-only mode and paused relayer actions. The status page subsequently marked the incident resolved and all systems operational. The outage lasted about an hour, from the initial investigation to the resolution notice. The company did not publish a detailed explanation of the breach alongside that notice.
Traders describe positions being sold
One of the earliest public warnings came from a trader posting on X as Car, who said $800,000 had been drained from their account and that a friend's account had lost another $600,000. Those figures are the trader's claims and have not been independently verified by Apex.
If you are a Polymarket user, lock down your account.
The trader followed that warning with another post saying, "All my positions were sold." That describes holdings being turned into cash before the money disappeared, rather than simply losing value because a prediction went wrong.
CoinDesk separately reported that it had confirmed users with balances on the international platform saw their accounts drained. Its report did not give an aggregate dollar amount. Polymarket's reimbursement promise also left the payment schedule and claims process unspecified.
Blockchain security company PeckShield had warned earlier that the site's user interface might have been compromised and urged people not to interact with it. That warning was tentative. The platform's later statement confirmed a compromised provider without naming it or spelling out how attackers reached user funds.
What the trading restrictions mean
Cancel-only mode lets traders cancel existing orders but blocks new ones, according to Polymarket's developer documentation. A pending order is an instruction to buy or sell, so canceling it doesn't reverse a completed trade or recover money that has already left an account.
The paused relayer serves a different purpose. It submits wallet operations, such as token transfers and spending approvals, on users' behalf without requiring them to handle the network transaction themselves. That makes it part of the system used to move funds, alongside the exchange where orders are matched.
The official status dashboard marked the predictions trading API as suffering a major outage while listing other services, including market data and onchain settlement, as operational. During the outage, a working website or visible account balance therefore didn't mean that normal trading had resumed.
The disruption came as the business was adding products elsewhere. CoinDesk reported Thursday that its regulated U.S. platform had introduced five-minute crypto up-or-down contracts the previous day. Those contracts let traders take a position on whether a cryptocurrency finishes a short window above or below its starting price.
A correct prediction pays $1 per share, while an incorrect one pays nothing. The launch puts another short-term trading product in front of American customers, with the result depending on which side of the starting price the asset finishes.
The U.S. venue is operated by QCX LLC under Commodity Futures Trading Commission oversight. Thursday's breach announcement specifically named the international site. It did not say the newly launched U.S. contracts or U.S. customer accounts had been affected.