Traders began reporting around 17:45 UTC on Oct. 29 that opening Polymarket triggers a malicious signature prompt that can drain the connected wallet, with warnings not to open the site, connect a wallet or sign anything (warning).

A message forwarded from Polymarket Discord says the exchange went to cancel-only mode with relayer actions paused while the team investigates (forward), as quoted (here).

Polymarket X had posted only market updates through 17:51 UTC, with no public confirmation in its recent posts, and the site itself still loads as normal markets.

Claimed losses circulating in posts include about $800k for one trader and over $2 million total, plus an alleged attacker address 0x3F99…fc18, but those are user claims, not verified onchain totals.

So for now: do not visit Polymarket, do not connect, do not sign, including withdrawals, and consider revoking approvals before interacting again.

Wait for an official all-clear from Polymarket team channels before using the frontend.