Polymarket attack via a third-party provider: what users should watch now

Polymarket temporarily halted trading on its international platform on October 29, 2026, after users reported unauthorized withdrawals. The attack ran through an external service provider that gave the attackers a way into accounts. The platform's trading contracts themselves were not affected. The company reopened trading the same day and promised full reimbursement to everyone affected.

For users in Germany, the incident shifts the question. The key issue is not whether a trading contract on the blockchain has been cleanly programmed. What matters more is how many outside services run on a trading site and what happens if one of them is taken over.

What happened at Polymarket: a compromised provider, not a code bug

Polymarket is a prediction market, a trading platform on which users buy and sell shares in the outcome of future events, with prices reflecting the estimated probability. Settlement runs through smart contracts, programs on a blockchain that execute stakes and payouts without an administering body.

According to the company, those programs were not the problem. Instead, attackers gained access to a provider whose code the platform had embedded in its website. Whoever controls such a service can change what the user sees and confirms in the browser without touching a single line of the trading contract.

The company has not named the provider. Citing an unnamed source, the news agency Reuters names a service for monitoring website speed; Forbes describes it as a website performance monitoring platform. Polymarket has not confirmed this attribution, and until it does, it remains second-hand information.

Around $2.65 million in POL: the range of loss estimates

There is no official figure. Polymarket itself has published neither the size of the loss nor the number of affected accounts. Observers' figures diverge, and they are presented here as a range.

Analyses by the research firm Arkham, cited by several trade outlets, put the figure at around $2.65 million, drained in POL, the token of the Polygon network on which Polymarket settles. The data service DeFiLlama lists just under $2.7 million. Crypto Economy reports $2.65 million and the resumption of trading.

The figures on the number of victims diverge even further. One report speaks of around $2.6 million across almost 1,000 accounts, another of about $3 million from fewer than 15 accounts. Both cannot be true at once, and each points to a different interpretation. A broad outflow across hundreds of accounts suggests a manipulated interface for all visitors, a narrow one suggests a few large accounts. Which reading holds is still open on the morning of October 30.

Cancel-only mode: how trading was temporarily narrowed

Polymarket put trading into a state in which no new orders could be placed, but existing ones could be cancelled. It was therefore not a complete shutdown. This cancel-only mode is the standard tool at exchanges during a disruption: it freezes the inflow while letting anyone out who wants out.

Reports of how long it lasted vary, from about half an hour to a longer interruption in the afternoon. What is certain is that the platform was running again the same day and the company reported all systems operational while the investigation continues.

Reimbursement and prosecution: what the company has promised

Polymarket has said it has fixed the problem and will fully reimburse all affected traders. According to Reuters, as reported by Forbes, the company has handed the case to UK law enforcement.

A promise is not yet a payment. If you are affected, you have no claim against a platform without a licence in the European Union that a German regulator would enforce. The only reliable evidence remains your own records: the time of the unauthorized withdrawal, the transaction ID on the blockchain and your correspondence with the provider.

The third incident since the spring: a pattern in the access layers

The case is not an isolated one. On June 28, 2026, cryptoticker.io reported on an incident at the same platform in which, as things stood then, around $3.1 million was drained; our assessment at the time is in our report on the Polymarket hack and the security risk of prediction markets. There too, a supplier was the starting point.

That is the real finding. For months, the attacks have come through the access points around the platform, not through its core. Interface, API and embedded third-party services are the soft layer on top of hard settlement.

Third-party providers as a gateway: why outside code runs on a trading site

Almost every major trading site embeds services it does not operate itself: error logging, load-time measurement, usage statistics, chat windows, payment modules. Each of these services delivers code that runs in the user's browser with the same rights as the site itself.

This attack route has a name: a supply chain attack, an attack not on the target but on one of its suppliers. It is attractive because a single compromised provider gives the attacker access to dozens of sites at once, and it is practically invisible to the user, since the address bar, certificate and branding remain unchanged.

A parallel from our own coverage is close at hand. In a data leak at a Coinbase service provider at the end of October 2026, balances were not affected; what leaked were contact details that could then be used for phishing. The pattern is the same: it was the exchange's supplier that was attacked.

Prediction markets and EU licensing: the framework for users in Germany

In Europe, prediction markets operate in an unsettled area. Depending on their design, they fall under financial instruments, under gambling or under neither category, and that classification decides which supervisor would be responsible at all. A licence under the EU Markets in Crypto-Assets regulation, MiCA for short, covers trading in crypto assets, not automatically bets on events.

In practice this means that anyone trading through a platform not licensed in the EU bears the default risk themselves. The deposit protection of up to €100,000 that applies at a bank does not exist here, and a complaint to BaFin against a provider without a German licence leads to no enforceable result. Trading through a provider licensed in the EU instead at least puts a supervisor behind you in a dispute.

Balances on a platform: custody and a trading account are not the same

In a case like this, the difference determines the damage. If a balance sits in a trading account, the provider holds the keys and keeps an internal record of your claim. If it sits in your own wallet, a program or device that stores the private key itself, control stays with the owner.

At Polymarket, users typically connect their own wallet to the platform. That is the better route, but it is not the safe route, because a connection is a permission. Once granted, it allows an application to dispose of your funds to a certain extent, and that permission is exactly the target when the interface is manipulated. The hardware wallet comparison shows which devices keep the key outside the browser and what they cost.

Wallet connection permissions: where a third-party provider gets in

In practice, a wallet connection covers more than displaying a balance. It includes approvals for individual tokens, which allow a contract to move a certain amount of a token, often with no upper limit and no expiry date.

An unlimited approval granted last year is still active today. The most important step after an incident like this is therefore to revoke old approvals, even before withdrawing your balance. If you have never done this, you are usually carrying around a dozen open permissions, most of which you have forgotten.

Leverage and liquidation: what a trading halt means for open positions

A leveraged trade means that a trader holds a larger position with borrowed money than their stake covers; if the price moves past a certain threshold, the position is forcibly closed. That point is called liquidation.

A trading halt hits twice here. If you cannot add margin or sell while the market moves, you lose control over your own stake. On prediction markets, positions usually run without leverage. At derivatives exchanges it is different, and there a cancel-only mode is the difference between limiting a loss and a forced close at the worst price. If you trade with leverage, you should know which outage rules your provider has set out in writing for disruptions.

Holding period and tax: what a reimbursement payment triggers in Germany

For tax purposes the case is awkward, because it mixes several transactions. Under the prevailing view, a theft of crypto assets is not a sale and therefore does not trigger a taxable gain; whether a loss can be claimed is disputed and depends on the individual case.

A reimbursement paid voluntarily by a provider, on the other hand, may be treated as a return of funds, and if it is paid in a different token from the one lost, that constitutes an exchange with its own holding period. The one-year holding period for private disposals starts afresh for the amount received. For your records, that means documenting the date and amount of the outflow and the date and form of the reimbursement separately. This is not tax advice, and for larger amounts the matter belongs in expert hands.

Polymarket: reimbursement promised, the risk remains in the access layer

The platform is trading again, and the promise of full reimbursement is more than users get after many incidents of this kind. Even so, the incident has shown where the weak point lies, and it is not where most people assume. Three things make sense now:

1. Revoke approvals. Withdraw old, unlimited token approvals for trading platforms, including platforms you no longer use. The software wallet comparison shows which wallets have this overview built in.
2. Separate trading balances from holdings. Leave only the amount you actively trade on the platform and move the rest into your own custody. A regulated exchange does not replace your own wallet; it is simply the route with a supervisor behind it.
3. Record what happened. Save transaction IDs, timestamps and correspondence before any reimbursement arrives, because the tax treatment needs both. A tax tool with a portfolio overview keeps the timestamps traceable.

(As of October 30, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)