Users began reporting around 17:45 UTC on Oct. 29 that Polymarket’s frontend may be compromised, with malicious signature prompts draining wallets (AggrNews), (report).

Users began reporting around 17:45 UTC on Oct. 29 that Polymarket’s frontend may be compromised, with malicious signature prompts draining wallets (AggrNews), (report).

Traders warned not to open the site, connect a wallet or sign anything, including withdrawals (warning). Claimed losses circulating in those posts include about $800k for trader Car and over $2 million total to the suspected attacker, but those figures are user claims, not verified onchain totals.

A message forwarded from Polymarket’s Discord says the exchange went to cancel-only mode with relayer actions paused while the team investigates (Discord forward), as quoted (here). An alleged attacker address was shared as 0x3F99…fc18 (relay link). Polymarket’s X account had posted only market updates through 17:51 UTC, with no public confirmation in its recent posts.