737 Polymarket wallets lost $2.73M in one hour. Every drain went through Polymarket's own wallet system
Hundreds of Polymarket balances fell to zero in a single hour. We followed every dollar out, to learn how it left, who lost it and where it sits now.
- $2.73M
- 985 drains
- 48%
- 4 accounts
- gfg44433
- 38 minutes
01 · What happenedWhat happened in the Polymarket hack
On Thursday evening, some Polymarket traders opened the site and found their accounts empty. One trader said $800K was gone. Others posted smaller losses on X and in Discord.
Polymarket is a prediction market. People buy shares in an outcome, like who wins an election or a match, and each share pays $1 if they are right. The site runs on Polygon, where it is one of the busiest apps on the network.
Bitquery traced each transfer with its Polygon data. In one hour, someone emptied 737 accounts and took $2.73 million. Each withdrawal had a valid approval from its own account and went out through the site's own systems. No smart contract was broken. The money left as POL, Polygon's own coin, and by the evening it was moving to Ethereum.
Polymarket says one of its outside providers was hacked, and that users will be made whole. We followed each withdrawal from the account it left to the wallet where it sits now.
02 · The setupHow a Polymarket account moves money
Each account keeps its money in a smart wallet of its own on Polygon. Polymarket calls it a deposit wallet. The cash inside is pUSD, the site's own dollar token, backed one to one by USDC.
The site pays the network fees for its users. When you trade or withdraw, you sign an approval with the wallet you log in with. The site's relayer, a service that pays the fee for you, sends it to the chain. Your deposit wallet checks that the approval is yours, then runs the action.
A withdrawal turns pUSD back into USDC, which can then go through Relay, an app that swaps and bridges coins, to any address and almost any coin you pick.
That day, each of those steps ran the way it always does. Only the address at the end belonged to someone else. It was the attacker's.
03 · The hourOne hour, 737 accounts
The first drains came in a small burst. Five accounts were emptied in three minutes, one of them for $75K. Then nothing happened for 13 minutes.
When the drains came back, they kept coming for 45 minutes, up to 40 in a single minute. A trader called Car posted a warning, telling users to lock down their accounts. By then, half of the money was already gone.
The biggest single drain, $358K, came from an account called hewhodoesit. The last drain of the hour landed ten minutes later. Thirty seconds after that, Polymarket's relayer sent its last transaction and went quiet.
Minutes later, reports said the exchange was in cancel-only mode, where traders can pull orders but not place new ones. The relayer was paused too. So the drains had stopped the moment the relayer did.
04 · The methodNo broken contract, just valid approvals
Each drain was one transaction for one account. Take the biggest. The deposit wallet of hewhodoesit approved a batch of steps, and the relayer sent it. The site's own tool turned the pUSD back into USDC, and then the Relay router took a small fee and swapped the rest into POL for the attacker.
All 985 drains on this route look the same. Each was sent by the same relayer wallets the site uses for normal traffic each day. Each carried an approval that the account's own wallet accepted.
The approvals were fresh. Each one has a time limit set an hour ahead, so the limit shows when the approval was made. In the 30 drains we checked, each approval was used 3 to 7 seconds after it was made. Nobody clicks through hundreds of accounts that fast. Software does.
So who could make those approvals? The chain shows they were valid, but it cannot show who made them. Two answers fit the record. Code planted on polymarket.com could have asked logged-in users to approve a withdrawal to the attacker, and one user reported a withdrawal request they never started. Or the keys behind those approvals leaked from a vendor's systems.
Polymarket blames a hacked outside provider. It has not named the firm or said how the approvals were made. Two days earlier, the Predict.fun hack looked much the same on-chain, with valid approvals and no broken contract. So did the LootBot drain. Whoever can approve for a wallet can empty it.
05 · The victimsWho got hit in the Polymarket hack
Most of the drained accounts held small sums. The median account lost $171. Two in five lost under $100.
The money came from a few big accounts. Four of them lost more than $100K each, 43% of the total, and our labels mark three of those four as profitable traders.
Our address labels give many of the drained wallets a public name. The account hewhodoesit lost the most. Takon88 came second. Two of the four largest accounts carry no public name.
Car's $800K does not match any single account in the record, so Car may use more than one account, or may count open bets at their market price. The friend Car said lost $600K does not match one account either.
06 · The signalThe drain stood out within minutes
A drain this big is loud on-chain. Users swap a withdrawal into POL through Relay only a few dozen times a day.
In the two weeks before, the median day had 47 of these swaps. On the day of the attack, the attacker's address alone received 981.
Nothing like it shows up in the two weeks before, so the attack started that day, and next to a normal fortnight it is the only thing on the chart.
07 · The betsThe stolen bets and a new account
The attacker took open bets too. Outcome shares, the tokens that pay $1 if a result comes true, left 33 accounts.
Shares are hard to cash outside the site. So the attacker opened a new account. Our labels name it gfg44433. Its wallet was made 34 minutes into the drain, and a minute later the stolen shares began to flow in.
The new account sold some shares on the exchange. It turned others straight back into pUSD through the site's own contracts. At 19:49 UTC it held $4,655 in pUSD.
That account is the clearest lead in the case. Whoever opened it went through the site's own sign-up. That leaves records Polymarket can check.
08 · The moneyWhere the stolen money went
Eighteen minutes after the last drain, the attacker began to move. Within ten minutes, all the POL had left for three new wallets.
Soon, money from two of those wallets was crossing to Ethereum through Relay and deBridge, apps that move coins between chains. Another slice took the slow road through Polygon's own bridge, and within the hour the attacker claimed it on Ethereum, swapped it for ETH and sent it to the same wallet as the rest.
The bridging did not go smoothly. Three of one wallet's Relay transfers failed. Relay refunded them in USDC, and the attacker swapped the USDC straight back into POL.
On Ethereum the coins landed as ETH. Most of it gathered in one fresh wallet, 0xe5e7…95f6, which held 126.10 ETH at 19:49 UTC. Bots were already sending the attacker's wallets fake transfers from look-alike addresses, hoping for a copy-paste slip.
Most of the money had not gone far. When we last read the chain, about $2.17M in POL still sat in three Polygon wallets, and each of them can be followed with the Bitquery MCP.
09 · The patternThe second Polymarket drain this year
This is the second drain this year that Polymarket blames on an outsider. In June, by press counts, a vendor's script was injected into the site, and about 11 wallets lost $2.94 million. The site promised full refunds.
The two attacks took about the same money in very different ways. June's hit a few large accounts, about $267K each. October's hit hundreds of accounts, about $3,700 each.
Hundreds of small accounts in one hour points to approvals made in bulk. That is hard to do by tricking people one at a time.
10 · The responseWhat Polymarket has said
Polymarket's first posts said it was looking into the reports. It had paused trading and the relayer. Twenty-three minutes after the last drain, it said it had found and fixed the cause. One of its outside providers had been hacked. It has told law enforcement, and it says users who lost money will be made whole.
The relayer came back 19 minutes after that statement. Nineteen minutes later, one more account was drained through it, and $10.99 went straight to the attacker. The approval was as fresh as the others, and the same account had already been drained once during the hour. It was the only late drain we found up to 19:49 UTC.
Polymarket has not named the firm. Nor has it said how many accounts were hit, or given a total. Early reports put the loss anywhere from hundreds of thousands to $2.65 million. Here is how those claims compare with the record.
| Source | Claim | Record | Verdict |
|---|---|---|---|
| Car | $800,000 drained from Car's account | The largest single account on this route lost $358,369 | Not one account |
| Car | A friend lost $600,000 | No single account lost more than $358,369 | Not one account |
| The Block | About $2.65 million | $2.73 million left the accounts. The attacker held a little less in POL after swap costs | Close, a little low |
| Polymarket | An outside provider was hacked | Every drain carried a valid approval. The chain cannot show who made them | Fits, not proven |
| Polymarket | The cause was found and fixed | One more drain came through the relayer at 19:11, 38 minutes later | Not yet borne out |
11 · What to doIf you use Polymarket
Polymarket says it will make users whole. Watch its own accounts for how. Ignore anyone who messages you about a refund.
Do not approve anything you did not start. A withdrawal you did not ask for is the warning sign users reported. Check the address on each withdrawal before you approve it.
Trading was halted when we read the chain. Check the site's status before you trade or withdraw.
12 · The methodHow we traced the Polymarket hack
We started from the address users shared, 0x3F99…fc18, and read every transfer into and out of it with Bitquery's Polygon data. For each payment into it, we read the rest of that transaction to find the account it came from. We read Relay's public records for each bridge request. Later moves came straight from the chain.
Names come from our labels. Trades come from the Polymarket API. The Ethereum side comes from our Ethereum data. The full history is also sold as files, as the Polygon, Polymarket and Ethereum datasets on the Bitquery Data Store. For cases like this, we also run crypto investigation services.
Transfers were read up to 19:49 UTC on 29 October on Polygon and Ethereum. Anything later is not covered.
Dollar totals count pUSD, USDC and USDC.e at $1. POL and ETH values use Relay's prices at 18:34 UTC: POL at $0.0908, ETH at $2,324.
Totals cover money paid to the attacker's address 0x3F99…fc18. Losses sent elsewhere by other routes are not counted, so the totals are a floor.
Outcome shares are counted, not valued. At most they are worth $1 each.
The record shows that each approval was valid. It does not show who made it, or how.
Names of accounts come from Bitquery's address labels and may be incomplete.
13 · The recordThe addresses behind the Polymarket hack
Follow the Polymarket money in plain English
Every transfer in this story comes from Bitquery's Polygon and Ethereum data. The Bitquery MCP server puts that data behind an AI assistant, so you can ask where a wallet's money went, or which labels an address carries, without writing a query. The full history is also sold as files on the Bitquery Data Store, as the Polygon dataset and the Ethereum dataset.
This article is provided for informational and educational purposes only and reflects analysis of publicly available on-chain data as of the dates indicated. It does not constitute legal, financial, compliance, or investment advice, and nothing in it is a recommendation to buy, sell or hold any token or asset, or to use or avoid any prediction market, wallet, bridge, protocol, exchange or service.
The findings describe transactions and balances observed on Polygon and Ethereum on 29 October 2026. Attributions come from Bitquery's address labels and from on-chain behaviour; they may be incomplete or incorrect and may be revised as more data becomes available.
References to Polymarket, Relay, deBridge, Polygon, The Block, PANews, Crypto Briefing, Car or any other named project, company, service or person describe what the public record shows about addresses and transactions linked to them, and what those parties have said in public. They are not statements about any party's intent, security practices, solvency or conduct, and nothing here asserts that any named party acted unlawfully or negligently. Account names are public Polymarket names and identify no person. The wallets that took the funds are described by their behaviour and attributed to nobody.
Nothing herein should be relied upon as a definitive determination of fact. Readers should conduct their own independent verification before taking any action. The authors and publisher accept no liability for any loss or damage arising from reliance on this material. All trademarks and company names are the property of their respective owners.
Reported by Gaurav Agarwal for Bitquery Research, with AI tools; every figure was checked against the raw data.
FAQ
Was Polymarket hacked?
Its users' accounts were. In one hour on 29 October, 737 accounts lost about $2.73 million. No smart contract was broken. Each withdrawal had a valid approval and went out through the site's own relayer. Polymarket says one of its outside providers was hacked.
How much was stolen in the Polymarket hack?
About $2.73 million in pUSD and USDC left 737 accounts in one hour. The attacker also took open bets from 33 accounts.
Will Polymarket refund users?
Polymarket said on X that users who lost money will be made whole. It has not yet said how or when.
Is Polymarket safe to use now?
Polymarket says it found and fixed the cause. Trading was halted while it brought the site back. One more account was drained after that statement. Do not approve any withdrawal you did not start, and check the address on every approval.
Where did the stolen money go?
It was swapped into POL and sent to one address. That address split it across three new wallets, which began bridging it to Ethereum through Relay, deBridge and Polygon's own bridge. Most of it was still on Polygon when we last read the chain.
Who was behind the Polymarket hack?
Nobody has been named. Mid-attack, the attacker opened a new account, gfg44433, to sell stolen bets. Polymarket has told law enforcement.
Run the next investigation in minutes
Ask any question of the blockchain. Bitquery's AI Investigations agent traces funds, attributes wallets, and writes auditable reports across every major chain. Prefer to do it yourself? Connect the Bitquery MCP server to your AI assistant, pull the raw datasets, or query the chain directly with the Bitquery API.