{ "version": 1, "event_id": "evt_a93f6f830eba8b2c", "url": "https://xiyu.news/events/evt_a93f6f830eba8b2c/", "json": "https://xiyu.news/api/events/evt_a93f6f830eba8b2c.json", "type": "security_incident", "status": "closed", "category": "crypto", "title": { "zh": "多名Polymarket用户报告资金被盗，平台限制交易并", "en": "Multiple Polymarket Users Report Stolen Funds as Platform Restricts Trading and" }, "current_state": { "zh": "Polymarket 第三方服务商遭入侵事件已标记为解决，超过 700 名用户受影响，被盗总额约 346 万美元，其中约 270 万美元已换成 POL 转出、约 75 万美元仍留在平台；平台此前承诺全额补偿并已移交执法部门。", "en": "The Polymarket third-party provider breach is marked resolved, with over 700 users affected and about $3.46 million stolen in total; roughly $2.7 million was converted to POL and transferred out, while about $750,000 remains on the platform. The platform previously promised full compensation and referred the matter to law enforcement." }, "first_seen_at": "2026-10-29T18:36:19.046340+00:00", "last_updated_at": "2026-10-30T02:53:16.166397+00:00", "last_material_change_at": "2026-10-30T02:53:16.166397+00:00", "confidence": 0.75, "updates_count": 5, "sources_count": 6, "entities": [ "funds", "incident", "investigates", "market", "multiple", "pauses", "platform", "polymarket", "prediction", "report", "restricts", "security-incident", "stolen", "trading", "user-funds", "users" ], "identifiers": [], "topics": [ "api-outage", "exchange-outage", "fund-losses", "incident-response", "polymarket", "prediction-market", "prediction-markets", "security-breach", "security-incident", "stolen-funds", "third-party-provider", "trading-halt", "user-funds", "wallet-drainer" ], "updates": [ { "update_id": "upd_724e6da556fcbb76", "event_id": "evt_a93f6f830eba8b2c", "occurred_at": "2026-10-29T18:31:48Z", "published_at": "2026-10-29T18:31:48Z", "first_seen_at": "2026-10-29T18:36:19.046340Z", "time_precision": "published", "update_type": "initial", "material_change": true, "title_zh": "多名Polymarket用户报告资金被盗，平台限制交易并", "title_en": "Multiple Polymarket Users Report Stolen Funds as Platform Restricts Trading and", "what_changed_zh": "Polymarket用户报告未经授权的资金转移和数十万美元损失，促使平台进入仅可取消模式，暂停中继器操作，并对疑似前端遭入侵展开调查。", "what_changed_en": "Polymarket users reported unauthorized fund transfers and hundreds of thousands of dollars in losses, prompting the platform to enter cancel-only mode, halt relayer actions, and open an investigation into a suspected frontend compromise.", "current_state_zh": "Polymarket用户报告未经授权的资金转移和数十万美元损失，促使平台进入仅可取消模式，暂停中继器操作，并对疑似前端遭入侵展开调查。", "current_state_en": "Polymarket users reported unauthorized fund transfers and hundreds of thousands of dollars in losses, prompting the platform to enter cancel-only mode, halt relayer actions, and open an investigation into a suspected frontend compromise.", "detailed_summary_zh": "Polymarket users reported unauthorized fund transfers and hundreds of thousands of dollars in losses, prompting the platform to enter cancel-only mode, halt relayer actions, and open an investigation into a suspected frontend compromise.", "detailed_summary_en": "Polymarket users reported unauthorized fund transfers and hundreds of thousands of dollars in losses, prompting the platform to enter cancel-only mode, halt relayer actions, and open an investigation into a suspected frontend compromise.", "background_zh": "Polymarket是一个预测市场平台，用户就未来事件的结果进行交易。今年6月，该公司披露黑客通过入侵一个第三方服务商窃取逾290万美元用户资金；Polymarket称该漏洞已修复、相关服务商已从其网站移除，受影响用户将获全额赔付，损失低于1万美元的钱包将在10月30日前自动收到退款，损失更大者需签署免责/放款文件。前端入侵——即将盗取钱包的代码注入网站或其第三方脚本——此前也曾冲击其他DeFi平台，包括Balancer和Aerodrome。", "background_en": "Polymarket is a prediction-market platform where users trade on the outcomes of future events. In June, the company reported that hackers drained more than $2.9 million in user funds by compromising a third-party vendor; it said that vulnerability was fixed, the vendor has been removed from its website and affected users would be fully reimbursed, with wallets losing under $10,000 receiving automatic refunds by October 30 and larger losses requiring a signed release form. Frontend compromises — in which wallet-draining code is injected into a site or its third-party scripts — have also hit other DeFi venues, including Balancer and Aerodrome.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "风险传导集中于Polymarket基于Polygon的链路：用户钱包中的USDC.e存款与POL持仓，以及负责提交签名交易的中继器通道，是直接受影响的环节，交易暂停也使该平台各预测市场的下单冻结。疑似前端/第三方服务商入侵的路径，还将供应链风险扩散至其他依赖外部托管脚本与中继器的DeFi平台。", "market_impact_en": "The exposure runs through Polymarket's Polygon-based rails: USDC.e deposits and POL holdings in user wallets, plus the relayer channel that submits signed transactions, are the directly affected segments, and the halt froze order placement across its prediction markets. The suspected frontend/third-party vendor vector extends supply-chain risk to other DeFi venues that rely on externally hosted scripts and relayers.", "importance_score": 8.0, "references": [ { "url": "https://cryptonews.com/news/bases-top-dex-aerodrome-hit-by-a-suspected-frontend-security-breach/", "title": "Base's Top DEX Aerodrome Hit by a Suspected Frontend Security..." } ], "confidence": 0.75, "story_ids": [ "telegram:wublockchainenglish:26608", "telegram:foresightnews:121696" ], "sources": [ { "url": "https://wublockchain.xyz/news/polymarket-users-report-stolen-funds-trading-restricted-investigation-21440", "label": "wublockchainenglish", "source_type": "telegram", "official": false }, { "url": "https://foresightnews.pro/news/h5Detail/116373", "label": "foresightnews", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_bcb2f414b3bc6a2c", "event_id": "evt_a93f6f830eba8b2c", "occurred_at": "2026-10-29T18:53:44Z", "published_at": "2026-10-29T18:53:44Z", "first_seen_at": "2026-10-29T22:41:45.288207Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "预测市场Polymarket调查安全事件期间暂停交易", "title_en": "Polymarket Pauses Trading as Prediction Market Investigates Security Incident", "what_changed_zh": "Polymarket确认一家第三方提供商遭入侵，已将此事移交执法部门，并表示受影响用户将获得全额补偿；研究人员将一个由DebugBear托管的钱包盗取脚本与一个持有约265万美元POL的疑似攻击者钱包关联起来。", "what_changed_en": "Polymarket confirmed a third-party provider was compromised, referred the matter to law enforcement, and said affected users will be made whole; researchers linked a DebugBear-hosted wallet-draining script to a suspected attacker wallet holding about $2.65 million in POL.", "current_state_zh": "Polymarket在调查已确认的第三方提供商入侵事件期间仍处于仅可取消模式，中继器操作暂停；执法部门已获通知，受影响用户获承诺补偿，一个疑似攻击者钱包和恶意前端脚本已被识别。", "current_state_en": "Polymarket remains in cancel-only mode with relayer actions paused while investigating a confirmed third-party provider compromise; law enforcement has been notified, affected users are promised reimbursement, and a suspected attacker wallet and malicious frontend script have been identified.", "detailed_summary_zh": "Polymarket halted trading and paused its relayer after confirming a third-party provider was compromised, as users reported unauthorized wallet withdrawals linked to a suspected attacker address holding about $2.65M in POL and a wallet-draining script traced to a vendor-hosted frontend dependency.", "detailed_summary_en": "Polymarket halted trading and paused its relayer after confirming a third-party provider was compromised, as users reported unauthorized wallet withdrawals linked to a suspected attacker address holding about $2.65M in POL and a wallet-draining script traced to a vendor-hosted frontend dependency.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.96, "story_ids": [ "rss:decrypt.co_feed:b9c8107aadce75be" ], "sources": [ { "url": "https://decrypt.co/382185/polymarket-pauses-trading-prediction-market-security-incident", "label": "Decrypt", "source_type": "rss", "official": false } ] }, { "update_id": "upd_c98a272b7920b45a", "event_id": "evt_a93f6f830eba8b2c", "occurred_at": "2026-10-29T19:23:03Z", "published_at": "2026-10-29T19:23:03Z", "first_seen_at": "2026-10-29T22:41:48.569452Z", "time_precision": "published", "update_type": "remediation", "material_change": true, "title_zh": "Polymarket在用户资金被窃取的报道中暂停交易", "title_en": "Polymarket suspended trading amid reports of user funds being drained", "what_changed_zh": "Polymarket 的系统已恢复，截至 UTC 19:05 所有系统均正常运行；此前因第三方服务商被入侵而暂停交易并进入仅取消模式。", "what_changed_en": "Polymarket's systems were restored and all were reported operational as of 19:05 UTC after trading was temporarily halted and the platform entered cancel-only mode due to a compromised third-party provider.", "current_state_zh": "Polymarket 在第三方服务商被入侵导致临时暂停交易和仅取消模式后，系统已恢复并恢复正常运行；受影响用户已获承诺赔偿，相关执法转介仍在背景下进行。", "current_state_en": "Polymarket's systems were restored and operational after a temporary trading halt and cancel-only mode caused by a compromised third-party provider; impacted users were promised reimbursement, with law enforcement referral in the background.", "detailed_summary_zh": "Polymarket temporarily halted trading and entered cancel-only mode after a third-party provider was compromised, as users reported unauthorized position sales and drained accounts; systems were later restored and impacted users were promised reimbursement.", "detailed_summary_en": "Polymarket temporarily halted trading and entered cancel-only mode after a third-party provider was compromised, as users reported unauthorized position sales and drained accounts; systems were later restored and impacted users were promised reimbursement.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.92, "story_ids": [ "rss:cointelegraph.com_rss:8d275b9040513b96" ], "sources": [ { "url": "https://cointelegraph.com/news/polymarket-suspends-trading-user-funds-compromised?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false } ] }, { "update_id": "upd_dbfabeb94394a6f3", "event_id": "evt_a93f6f830eba8b2c", "occurred_at": "2026-10-30T00:46:22Z", "published_at": "2026-10-30T00:46:22Z", "first_seen_at": "2026-10-30T02:53:16.161873Z", "time_precision": "published", "update_type": "aftermath", "material_change": true, "title_zh": "【Polymarket 今晨第三方服务商被入侵，交易暂停约一小时】", "title_en": "【Polymarket 今晨第三方服务商被入侵，交易暂停约一小时】", "what_changed_zh": "据 Bubblemaps 监测，此次事件影响超过 700 名用户，被盗资金约 270 万美元；状态页已将事件标记为已解决。", "what_changed_en": "Bubblemaps monitoring indicates more than 700 users were affected and about $2.7 million in funds were stolen; the status page marked the incident as resolved.", "current_state_zh": "Polymarket 系统已恢复，事件被标记为已解决；据 Bubblemaps 监测，超过 700 名用户受影响、约 270 万美元资金被盗，平台承诺全额补偿并已将此事移交执法部门。", "current_state_en": "Polymarket's systems are restored and the incident is marked resolved; Bubblemaps monitoring indicates over 700 users were affected and about $2.7 million was stolen, with the platform promising full compensation and referring the matter to law enforcement.", "detailed_summary_zh": "Polymarket paused trading for about an hour after a third-party service provider was compromised, affecting more than 700 users and roughly $2.7 million in funds, with the platform promising full compensation and referring the matter to law enforcement.", "detailed_summary_en": "Polymarket paused trading for about an hour after a third-party service provider was compromised, affecting more than 700 users and roughly $2.7 million in funds, with the platform promising full compensation and referring the matter to law enforcement.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.5, "references": [], "confidence": 0.92, "story_ids": [ "telegram:foresightnews:121695" ], "sources": [ { "url": "https://foresightnews.pro/news/h5Detail/116372", "label": "foresightnews", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_5a088c80f1c87231", "event_id": "evt_a93f6f830eba8b2c", "occurred_at": "2026-10-30T00:53:39Z", "published_at": "2026-10-30T00:53:39Z", "first_seen_at": "2026-10-30T02:53:16.166397Z", "time_precision": "published", "update_type": "aftermath", "material_change": true, "title_zh": "【Polymarket 被盗涉超 700 名用户，损失约 346 万美元】", "title_en": "【Polymarket 被盗涉超 700 名用户，损失约 346 万美元】", "what_changed_zh": "Bubblemaps 监测显示被盗总额约 346 万美元，而非此前约 270 万美元；其中约 270 万美元已换成 POL 转出，约 75 万美元仍留在 Polymarket。", "what_changed_en": "Bubblemaps monitoring indicates total stolen funds were about $3.46 million, rather than the earlier ~$2.7 million figure; about $2.7 million was converted to POL and transferred out, while about $750,000 remains on Polymarket.", "current_state_zh": "Polymarket 第三方服务商遭入侵事件已标记为解决，超过 700 名用户受影响，被盗总额约 346 万美元，其中约 270 万美元已换成 POL 转出、约 75 万美元仍留在平台；平台此前承诺全额补偿并已移交执法部门。", "current_state_en": "The Polymarket third-party provider breach is marked resolved, with over 700 users affected and about $3.46 million stolen in total; roughly $2.7 million was converted to POL and transferred out, while about $750,000 remains on the platform. The platform previously promised full compensation and referred the matter to law enforcement.", "detailed_summary_zh": "A breach at a Polymarket third-party service provider led to the theft of about $3.46 million from more than 700 users, with roughly $2.7 million converted to POL and transferred out.", "detailed_summary_en": "A breach at a Polymarket third-party service provider led to the theft of about $3.46 million from more than 700 users, with roughly $2.7 million converted to POL and transferred out.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.5, "references": [], "confidence": 0.96, "story_ids": [ "telegram:foresightnews:121701" ], "sources": [ { "url": "https://foresightnews.pro/news/h5Detail/116378", "label": "foresightnews", "source_type": "telegram", "official": false } ] } ] }