Polymarket Exploit Pauses Trading After $2.65M Loss
Polymarket froze all new trades on 29 October 2026 after an exploit drained more than $2.5 million (USD) in minutes. Anyone holding funds on a prediction market should pay attention, since one breach can lock an entire exchange.
What actually happened
According to The Block, Polymarket lost over $2.5 million (USD) within minutes on 29 October 2026. The outlet's headline puts the figure at $2.65 million (USD) and attributes the breach to a compromised third-party provider. Polymarket responded by switching its exchange into cancel-only mode, a setting that lets users cancel open orders but blocks fresh trades. The report does not name the affected markets, tokens, or vendor. No Polymarket statement, recovery plan, or restart date appears in current coverage. For everyday users, this means positions are frozen, not necessarily lost, until the platform clears the issue.
How we got here
Prediction markets built on blockchain rails have expanded fast since 2024, letting people trade on outcomes from elections to sports. Few run every piece of infrastructure themselves. Most lean on outside vendors for data feeds, custody, or order matching, even while settlement happens on-chain. That split creates a weak point: a platform's safety depends on partners it does not fully control. The Block frames this incident as a third-party failure, not a flaw in Polymarket's own contracts, though it does not name the vendor. For readers who track wallet-linked apps, this echoes past bridge and oracle hacks seen across DeFi.
Why this matters for you
For Polymarket traders, cancel-only mode means no new bets until the exchange reopens, though existing orders can still be pulled. For anyone connecting a wallet to prediction markets or similar apps, the incident is a reminder to check which permissions and vendors sit behind an app's interface. A clean smart contract does not guarantee a clean supply chain. For the bonuz ecosystem, where wallet users interact with multiple third-party services, it reinforces why vetting partners matters as much as auditing code. Token holders tied to prediction markets should expect short-term caution until Polymarket confirms losses and any repayment plan.
The bigger question
The exploit raises a wider question for crypto apps everywhere: who should absorb losses when a trusted vendor, not the platform's own code, fails? As more wallets and markets outsource data, custody, or matching to third parties to cut costs, the boundary between a platform's security and its partners' security keeps blurring. When that boundary breaks, should the platform, the vendor, or the user carry the loss?
What to watch
Polymarket has not set a date for restoring full trading. Watch for an official breakdown naming the compromised provider, confirmation of total losses, and any reimbursement plan for affected users. Further reporting is expected from The Block and other outlets covering DeFi security. bonuz.market will track whether this changes how wallet users approach prediction markets.
