Polymarketning xalqaro platformasi uchinchi tomon provayderi buzib kirilgandan so'ng savdoni vaqtincha to'xtatdi, bu esa ruxsatsiz yechib olishlar va hisob balanslarining yo'qolishi haqida xabarlarga olib keldi.
Keyinchalik Polymarket Traders akkaunti savdo qayta tiklanganini e'lon qildi va zarar ko'rgan treyderlarga to'liq kompensatsiya to'lashni va'da qildi.
Ochiq hodisa bayonotida akkaunt Polymarket.com ga ta'sir qilgan muammoni aniqlagan va tuzatganini aytdi hamda uni tegishli huquqni muhofaza qiluvchi organlarga yuborganini bildirdi. Biroq, bayonotda buzib kirilgan provayderning nomi aytilmadi va hujumchilar mablag'larga qanday kirganligi tushuntirilmadi.
"Zarar ko'rgan har kim to'liq qoplanadi," — deyiladi bayonotda, shuningdek savdo "ehtiyotkorlikdan" vaqtincha to'xtatilgani qo'shimcha qilindi.
Tiklanish e'loniga foydalanuvchilarning javoblari orasida balanslar yo'qolganligi haqida shikoyatlar bor edi. Bir treyder o'z hisobida nol mablag' ko'rsatilganini va ruxsatsiz yechib olishni sezganini aytdi. Boshqasi esa platforma qayta onlayn ekanligini, lekin pullari qaytib kelmaganini bildirdi. Bular mustaqil tasdiqlanmagan yo'qotish baholari emas, balki alohida xabarlardir.
Akkount dastlab savdo taxminan ET vaqti bilan soat 15:00 da qayta tiklanishini e'lon qildi, so'ngra keyingi yangilanishda to'liq tiklanishni tasdiqladi.
"Biz buni to'g'rilaymiz va zarar ko'rgan barcha treyderlarga to'liq kompensatsiya to'laymiz," — deyiladi keyingi bayonotda. Unda kompensatsiya muddati, muvofiqlik mezonlari yoki batafsil da'vo jarayoni ko'rsatilmagan.
Tashqi provayderning ishtiroki tasdiqlanganligi uchinchi tomon xavfsizligini tekshiruvning markaziy masalasiga aylantiradi. Shunga qaramay, mavjud bayonot hujumchilar autentifikatsiya infratuzilmasini, hamyon xizmatlarini, ilova kodini yoki boshqa integratsiyani buzib kirganligini aniqlamaydi.
Hamyon operatorlarini nishonga olgan Web3 ta'minot zanjiri hujumlari bo'yicha alohida tekshiruvlar zararli bog'liqliklar shaxsiy kalitlar va tiklash iboralarini o'g'irlashini hujjatlashtirgan. Bular alohida hujum mexanizmlarini ko'rsatadi, bu hodisa qanday sodir bo'lganiga dalil emas.
Ko'rib chiqilgan bayonotlarda ekspluatatsiya zanjiri, zararli hamyon manzillari, tranzaksiya xeshlari, buzilish ko'rsatkichlari yoki zarar ko'rgan foydalanuvchilar soni yo'q. Shuning uchun hodisani ma'lum tahdid aktoriga bog'lash yoki uni tasdiqlangan aqlli shartnoma ekspluatatsiyasi deb ta'riflash mavjud dalillardan oshib ketadi. Biz Polymarket.com xalqaro platformamizga ta'sir qilgan muammoni aniqladik va tuzatdik. Uchinchi tomon provayderlarimizdan biri buzib kirildi va biz bu haqda tegishli huquqni muhofaza qiluvchi organlarga xabar berdik.
Zarar ko'rgan har kim to'liq qoplanadi.
Ehtiyotkorlikdan...
— Polymarket Traders (@PolymarketTrade) 2026-yil 29-oktabr
Tiklanish e'lonida aytilishicha, darhol operatsion uzilish tugagan. Biroq, kompensatsiya hali ham ochiq hujjatlashtirilgan, yakunlangan jarayon emas, balki majburiyatdir.
Hal qilinmagan savollar orasida provayderning shaxsi, ruxsatsiz kirish doirasi, umumiy yo'qotishlar va ochilgan ma'lumotlar yoki hamyon ruxsatlari qo'shimcha tuzatishni talab qiladimi-yo'qmi kiradi. Qo'shimcha natijalar paydo bo'lmaguncha, bu texnik chegaralar noaniq qoladi.v
SOCingizga hodisalarni tez to'xtatish uchun ogohlantirish kontekstini bering.16K SOCdan tahdid razvedkasini integratsiya qiling.
Polymarket’s international platform temporarily suspended trading after a third-party provider was compromised, leading to reports of unauthorized withdrawals and missing account balances.
The Polymarket Traders account later announced that trading had resumed and promised to reimburse affected traders fully.
In its public incident statement, the account said it had identified and fixed the issue affecting Polymarket.com and referred it to relevant law enforcement. However, the disclosure did not identify the compromised provider or explain how attackers accessed funds.
“Anyone who has been impacted will be made whole,” the statement said, adding that trading was temporarily halted “out of an abundance of caution.”
User responses to the restoration announcement included complaints about depleted balances. One trader reported that their account showed zero funds and that they had noticed anunauthorized withdrawal. Another said the platform was back online, but their money was not. These remain individual reports rather than independently verified loss assessments.
The account initially announced that trading would resume at approximately 3 p.m. ET, then confirmed full restoration in a subsequent update.
“We’ll make this right and are fully reimbursing all affected traders,” the follow-up statement said. It did not provide a reimbursement deadline, eligibility criteria, or a detailed claims process.
The confirmed involvement of an external provider makes third-party security central to the investigation. Nevertheless, the available disclosure does not establish whether attackers compromised authentication infrastructure, wallet services, application code, or another integration.
Separate investigations into Web3 supply-chain attacks targeting wallet operators have documented malicious dependencies harvesting private keys and recovery phrases. These illustrate distinct attack mechanisms, not evidence of how this incident occurred.
The reviewed statements contained no exploit chain, malicious wallet addresses, transaction hashes, indicators of compromise, or affected-user count. Consequently, attributing the incident to a particular threat actor or describing it as a confirmed smart-contract exploit would exceed the available evidence. We've identified & fixed an issue impacting our international platform, Polymarket.com. One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement.
Anyone who has been impacted will be made whole.
Out of an abundance of caution, we…
— Polymarket Traders (@PolymarketTrade) October 29, 2026
The restoration announcement says the immediate operational disruption has ended. However, reimbursement remains a commitment rather than a publicly documented, completed process.
The unresolved questions include the provider’s identity, the scope of unauthorized access, total losses, and whether exposed credentials or wallet permissions require further remediation. Until additional findings emerge, those technical boundaries remain unclear.v
Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.