hack or exploit

Polymarket restricts trading to cancel-only mode amid wallet drain reports

76Importance
updatingStatus
9News media
10Pieces
Published
Updated
Since then
8 new reports

Polymarket moved trading into cancel-only mode and paused its relayer after reports of a wallet drain. Existing orders could still be canceled, while new buy and sell orders were blocked.

Key claims & sources

✓
Polymarket restricted trading to cancel-only mode after reports of wallet drains surfaced.
✓
Polymarket paused its relayer during the incident.
✓
Existing orders could still be canceled while new buy and sell orders were blocked.

What it means

Polymarket is a decentralized prediction market, so its trading rails and wallet controls are part of the product itself rather than a separate brokerage layer. A cancel-only restriction changes how users interact with open positions because it preserves exits on standing orders while stopping fresh exposure. The episode lands at a time when users are already expected to manage their own wallet security on-chain.

For traders on Polymarket, the immediate effect is that they could not place new buy or sell orders while the platform stayed open for order cancellation. That shifts activity from active trading to damage control and leaves anyone trying to adjust a market view waiting for normal access to return. The reported $800,000 drain also shows how large balances in connected wallets can become a direct operational risk.

Decentralized venues promise open access, but an incident like this puts security and continuity ahead of normal market function. Pausing a relayer shows how much of the user experience still depends on infrastructure that can be switched off when something looks wrong. The trade-off is visible: the same architecture that reduces gatekeeping can also make operational interruptions harder to absorb.

What is not yet clear is the full scope of the wallet drains, whether other users were affected, and how long the cancel-only restriction will remain in place. The next useful detail would be a platform update on the relayer pause and the status of any affected accounts. Until then, the open question is how Polymarket will restore normal trading while keeping the same wallets and orders safe.

Market reaction i

Total crypto marketall crypto assets combined no single asset in the event: read against the whole market
first headline
-0.9% 2 h before
+0.1% 4 h after
$2.7Tmarket cap at publication
7data points

The move was larger before the first headline than after. That is an observation, not an explanation: the market also moves on things nobody publishes.

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Oct 29 18:12
+15 min
Oct 29 18:27
The Defiant context
Its angle: canceled, existing, defiant
+22 min
Oct 29 18:35
BeInCrypto adds
Adds $1.4M, with quotes
+27 min
Oct 29 18:39
Crypto Briefing echo
No new facts: comprehensive, vulnerability, persistent
+29 min
Oct 29 18:41
+41 min
Oct 29 18:53
+43 min
Oct 29 18:55
+49 min
Oct 29 19:01
U.Today adds
Sharpens the figure: $2.6M
+1 h 10 m
Oct 29 19:23
Cointelegraph echo
No new facts: providers, suspended, markets

Thefts of a similar size

WhenWhat happenedFigure
5 months ago RetoSwap incident $2.7M
5 months ago RetoSwap incident $2.7M
8 months ago Solv Protocol incident $2.7M
11 months ago Aevo incident $2.7M
4.6 years ago Fantasm Finance · Business logic in mint() incident $2.6M

4246 incidents stored · 653 were as large as this one or larger ($2.6M)