Polymarket locks withdrawals behind a 48-hour wait after $2.7M breach

Polymarket rolled out a withdrawal whitelist on Monday. Josh Stevens, the prediction market's vice president of engineering, said on X from his @devjoshstevens account that traders can now only send funds to wallets they have already approved. Adding an address takes two steps: confirm the request by email, then wait 48 hours. Anyone who didn't start the request can kill it from that same email. Stevens said the point is to stop attackers from pushing money to any address the user doesn't control.

The lock is a patch, not a cure. The breach it follows unfolded on October 29, when Polymarket paused trading on its international platform after attackers took over a script from DebugBear, a UK website-speed monitoring firm, and swapped it for wallet-draining code. Researchers at Hudson Rock found the replacement checked whether visitors were logged into Polymarket, read their balances and open positions, then used the site's own trading tools to sell positions and route the cash to an attacker wallet. Hudson Rock also found Polymarket's site code logged the script's removal. Polymarket said it handed the case to law enforcement.

Bitquery put the damage at $2.73 million pulled from 737 accounts inside roughly one hour, between 17:10 and 18:10 UTC. The attackers fired off 985 withdrawals, every one carrying a valid approval, so the smart contracts read them as genuine user actions. One account lost $358,369 in a single withdrawal, while 276 accounts lost under $100 each. Another 33 users had prediction-market shares taken. Polymarket has promised to make all users whole, with losses under $10,000 refunded first.

This isn't Polymarket's first brush with a third-party script. In June, a vendor-script attack drained about $3 million from at least 11 wallets, according to earlier Cryptopolitan reports, and a December 2025 breach at an authentication provider also hit user accounts. Every incident traced back to an outside provider, though nothing so far links them to a single attacker.

Binance and Polymarket have also asked Polygon validators to approve a hard fork, a network software change every validator has to adopt. It would shift about 70.49 million frozen POL tokens, worth around $6.5 million, out of attacker wallets. The proposal went up on November 4 and was presented during a Polygon governance call on November 5; a vote and a date are still pending. Elsewhere, security firm CertiK reportedly said that after the $6.3 billion Binance hack, exchanges should cap how much they hold in hot wallets with hard dollar limits rather than leaning on cold-storage ratios alone.