Polymarket Pauses Trading After Frontend Security Breach
A compromised third-party vendor allowed hackers to hijack sessions and drain over $2.6 million from user accounts.
Updated on Oct. 29, 2026 in Cybersecurity
Live Poll
Do you trust cryptocurrency exchanges to keep your funds safe from cyberattacks?
Polymarket temporarily halted all trading activity after a malicious script injected by a third-party vendor hijacked authenticated user sessions. The breach resulted in more than $2.6 million being drained from the platform before trading was eventually restored.
Why it matters
The incident highlights significant supply chain vulnerabilities in decentralized platforms that rely on external vendors for frontend components. Simultaneously, the freezing of billions in assets linked to suspicious Binance outflows underscores the massive scale of current crypto security risks.
Hackers utilized a malicious JavaScript injection to hijack user sessions on the Polymarket frontend. Separately, massive Binance hot wallet outflows triggered the freezing of $1.567 billion in USDT and remaining funds in USDC.
The players
Polymarket
This decentralized prediction market platform allows users to trade on the outcomes of real-world events.
Binance
This is one of the world largest cryptocurrency exchanges that manages significant volumes of digital assets in hot wallets.
Tether
This company issues the USDT stablecoin and operates the central repository for these digital assets.
Circle
This financial technology firm is the primary issuer of the USDC stablecoin.
Tornado Cash
This decentralized, non-custodial privacy tool allows for the obscuring of the origin and destination of cryptocurrency transactions.
The details
The breach at Polymarket allowed attackers to liquidate user positions through the hijacked sessions, with blockchain trackers tracing $2.5 million of the stolen funds to a single address. In a related event, Tether and Circle moved to freeze $1.79 billion in assets following massive, rapid outflows from Binance hot wallets.
Timeline
June 2026: Polymarket experienced a similar vendor-compromise attack.
October 29, 2026, 2:33 p.m. ET: Polymarket restricted trading to cancel-only mode.
October 29, 2026, 3:03 p.m. ET: Polymarket restored trading.
October 29, 2026, 20:24-21:04 UTC: Binance hot wallets experienced large outflows.
The Tech Race
The incident mirrors past events where attackers used the obfuscation capabilities of the Tornado Cash protocol to hide the movement of stolen digital assets. This highlights a persistent arms race between platform security and tools designed to anonymize high-volume crypto transfers.
Users of decentralized exchanges face increased risks of asset liquidation when third-party vendors are compromised. Traders should be aware that platform-wide trading pauses are possible during these security incidents, potentially restricting access to their funds.
The takeaway
Users should prioritize using multi-factor authentication and monitor their account activity for unauthorized changes during high-volatility events. Security breaches at the frontend level demonstrate that even decentralized protocols are vulnerable to supply chain attacks.
Further reading
For more on the current state of digital defense, visit our Cybersecurity section.
Live Poll
Do you trust cryptocurrency exchanges to keep your funds safe from cyberattacks?
