Polymarket Is Trading Again, but the Trust Behind the Bets Is Still Under Repair
Polymarket has resumed trading after pausing its platform in response to a 2.65 million USD exploit, and the prediction market giant says a compromised third-party provider was to blame. For a platform that processed hundreds of millions in wagers through a brutal election season, the resumption is good news for users who spent days unable to touch their positions. But the episode was Polymarket’s second security incident in four months, and for a company trying to become financial infrastructure, that pattern is now the story.
What Happened This Time
According to the company, attackers compromised a third-party provider in Polymarket’s software supply chain, and drainer scripts ended up running in a context where they could reach user funds. Trading was halted while the team investigated, the malicious code was removed, and the platform came back online after remediation. The 2.65 million USD loss is small by the standards of 2026’s megahacks, but the mechanism is what unsettles security researchers: users did nothing wrong, visited no fake site, and signed no malicious transaction. The attack lived in infrastructure they had already trusted.
That is the same class of failure that hit a dozen DeFi websites in October through a single domain registrar and that touched the industry’s crime-tracking firm Chainalysis in a separate breach. The perimeter of crypto is no longer the wallet or the app. It is the sprawling web of vendors, registrars, analytics providers, and code dependencies that every platform stitches together.
Second Breach in Four Months Changes the Math
In July, Polymarket suffered a multimillion-dollar security breach involving drainer scripts, and the company promised a hardening of its systems. Four months later, a different attack vector produced a similar outcome. Security professionals will tell you that two incidents of different types are not automatically evidence of negligence, they can simply reflect a high-profile target absorbing the industry’s current attack wave. Users, however, do not weigh incidents by attack vector. They count headlines.
The timing is particularly awkward because prediction markets are having their commercial breakout. Robinhood just disclosed that event contracts out-earned crypto trading on its platform, 173 million USD versus 120 million USD in a single quarter, and Coinbase is building toward 200 million USD in annualized prediction market revenue. Kalshi is fighting criminal charges in Utah while expanding aggressively. Polymarket, as the best-known brand in the category, is positioned to ride that wave, unless repeated breaches reposition it as the category’s cautionary tale.
Why Prediction Markets Can’t Afford Custodial Doubt
A prediction market only works if users believe two things: that the outcome resolution is honest and that their deposited funds are safe until settlement. The first has been Polymarket’s strength, with resolution disputes rare relative to its volume. The second is now in question. Every bet is a position held for days, weeks, or months, meaning the platform is effectively a custodian of user capital for extended periods. An exchange that gets hacked can reimburse and move on. A prediction market that gets hacked twice asks its users to pre-commit money to a future that suddenly looks less certain.
The election cycle raises the temperature further. With midterms days away, political event contracts are the fastest-growing segment of the category, and Washington’s arguments over the Binance hack have pushed market-integrity questions to the front of the regulatory queue. A platform that cannot keep drainer scripts out of its stack is going to feature in those conversations whether it likes it or not.
What Users Should Watch Now
The resumption of trading is step one. The credibility rebuild is the long game. Watch for a published post-mortem with the third-party failure explained in detail, a bug bounty expansion, and independent security audits that specifically cover the supply chain rather than just the core contracts. Watch whether Polymarket introduces withdrawal delays or allowlisting for new sessions, friction that signals seriousness about the drainer threat. Most of all, watch the next quarter: if a third incident lands, the narrative writes itself.
For users in the meantime, the standard hygiene applies. Use a dedicated wallet for prediction market positions rather than your main holdings, keep position sizes within what you could tolerate losing during another outage, and treat any message claiming to help recover exploit losses as a scam until proven otherwise.
The Bottom Line
Polymarket reopened its markets, and the betting public will likely return quickly, because liquidity is a powerful magnet. But 2026 has taught crypto users that resumption is not the same as resolution. The platform’s real test is not whether trading resumes after the next incident, it is whether there is no next incident. Until then, the smartest position on Polymarket may be the one you can afford to have frozen for a week.
Disclaimer: This article is for informational purposes only and does not constitute financial advice. Crypto investments carry risk; always do your own research.
Users signed nothing, visited nothing, and still got drained via a compromised third party in the supply chain. That is the part that should scare every platform bolting on outside infrastructure vendors.
Two incidents in four months is a pattern for a company pitching itself as financial infrastructure. 2.65 million is small change next to the megahacks this year yet the trust hit compounds way faster.
The trust compounding cuts both ways though. Kalshi is right there with a US license, every incident like this hands them a marketing slide for free
users count headlines, exactly. and robinhood posting 173m on event contracts means a queue of rivals is happy to absorb anyone who actually leaves over this
Resumed trading is nice. I want the postmortem on which provider got popped and whether the drainer scripts ran before or after their code review window. Until then my positions stay small.
same, positions small until the vendor is named. also want to know how long the drainer sat in the pipeline before someone noticed the 2.65m moving
Agreed on the postmortem demand. If the compromised provider is not named publicly, every other platform using similar vendors is flying blind.
second breach in four months and trading volume will still bounce back within a week. prediction market degens have zero memory
zero memory is right, i refreshed the market the minute trading came back. at least the exposure was capped at 2.65m and not user wallets
capped at 2.65m this time because the treasury ate it. july was drainer scripts too, one of these rounds the code lands on user wallets instead
Robinhood just posted 173 million from event contracts against 120 million from crypto trading. That demand is exactly why this bounces back.
2.65 million is pocket change next to what polymarket books daily. not defending the security team, just saying the incentive to fix this is massive
resumed trading in hours after getting exploited twice in four months. thats the whole degen culture in one headline lol