Polymarket rolls out 48-hour withdrawal time lock after $2.7M vendor script breach

Polymarket has added a new setting that only allows traders to send withdrawals to pre-approved wallets.

The feature arrives about two weeks after a hacked script drained around $2.7 million from user accounts. 

What does Polymarket’s new withdrawal lock do?

Josh Stevens, Polymarket’s vice president of engineering, announced on Monday that Polymarket would be adding a new feature that will only allow traders to send withdrawals to previously approved wallets. The announcement was made in a post on X from the @devjoshstevens account. 

Adding a new wallet address to a user account takes only two steps. The trader must confirm the request by email, and then wait 48 hours. If the trader did not start the request, they can cancel it straight from that email.

With this measure in place, attackers will no longer be able to send money to a new wallet without passing the email check and waiting the required two days. Stevens said the goal is to make sure attackers cannot send money to any address the user does not control.

However, the lock does not fix the root problem of the breach Polymarket experienced just two weeks ago. That hack led to about $2.7 million being drained from user accounts. It was done through a third-party script running inside the Polymarket site with access to live sessions.

Polymarket faced this kind of problem earlier this year in June when it experienced a vendor-script attack that resulted in the draining of about $3 million from at least 11 wallets, according to earlier Cryptopolitan reports. A December 2025 breach at an authentication provider also hit user accounts. 

Each of these cases involved an outside provider, but nothing links them to one attacker.

How did the Polymarket hack happen, and what comes next?

On October 29, Polymarket paused trading on its international platform after attackers took over a script from DebugBear, a UK company that monitors website speed. The script was swapped for code built to drain wallets.

Researchers at Hudson Rock found that the code checked whether a visitor was logged in to Polymarket. It then read their balances and open positions. Finally, it used the site’s own trading tools to sell positions and send the money to an attacker’s wallet. 

Hudson Rock also found that Polymarket’s site code recorded the script’s removal. Polymarket said it referred the case to law enforcement. 

Bitquery reported that the attackers took $2.73 million from 737 accounts in about one hour, between 17:10 and 18:10 UTC. They made 985 withdrawals, and each one carried a valid approval. The smart contracts therefore treated them as real user actions. 

One account lost $358,369 in a single withdrawal, while 276 accounts lost less than $100 each. Another 33 users also had prediction-market shares taken.

Polymarket said it will make all its users whole, but people who lost less than $10,000 will be refunded first.

Binance and Polymarket have also asked Polygon validators to approve a hard fork. A hard fork is a network software change that all validators must adopt. This one would move about 70.49 million frozen POL tokens, worth about $6.5 million, out of attacker wallets. The proposal was posted on November 4 and presented at a Polygon governance call on November 5. A vote and a date are still pending. 

Other firms are also tightening security. On Tuesday, security firm CertiK reportedly stated, following the $6.3 billion Binance hack, that exchanges should set hard dollar limits on how much they keep in hot wallets, instead of relying only on cold-storage ratios.