Is Polymarket safe? Here is what is confirmed after the October incident, and what is still unknown.

Users reported that assets were leaving their accounts without authorization, Polymarket's status page showed a major outage of its trading API, and the exchange went into cancel-only mode, where traders can withdraw existing orders but not place new ones, with relayer actions paused. Polymarket then said on X that it had "identified & fixed an issue impacting our international platform, Polymarket.com", that "one of our 3rd party providers was compromised, and we have referred this to relevant law enforcement", and that "anyone who has been impacted will be made whole" (Decrypt, 29 October 2026, read 5 November 2026).

Cointelegraph reports Polymarket's status page showing every system working again at 7:05 pm UTC, and notes that its report gives no details on amounts, timing or process for making users whole (Cointelegraph, 29 October 2026, read 5 November 2026). The Block says Polymarket reported it had found the cause and fixed it, and that Arkham data tied a suspected attacker's wallet to roughly $2.65 million in POL, obtained by swapping USDC.e. It does not report how many accounts were affected, and the provider is not named (The Block, 29 October 2026, read 5 November 2026).

Decrypt adds that Hudson Rock found wallet-draining code in a script hosted by a third party, which names the same wallet as its fallback recipient, and that Hudson Rock said it had not determined how the breach began or how many users were affected (Decrypt, 29 October 2026, read 5 November 2026).

Decrypt's report of 29 October recalls about $700,000 lost in May through a compromised private key, and about $3 million taken from fewer than 15 accounts a month later through a compromised vendor (Decrypt, read 5 November 2026).

The Next Web reports that Polymarket confirmed the June theft on 25 June 2026. PeckShield, a blockchain monitoring firm, put the losses at about $3 million across more than 11 victims. A compromised third-party vendor let attackers inject malicious code into Polymarket's frontend, and Polymarket said it was reaching out to victims and "refunding them in full" (The Next Web, 25 June 2026, read 5 November 2026).

The developer documentation calls the Deposit Wallet "the default smart wallet for trading on Polymarket" and says all account wallets deployed on or after 4 May 2026 use it. It says "each wallet remains controlled by its signer", that "the signer authorizes the complete batch, and the Relayer submits it gaslessly", and that trading approvals allow Polymarket's exchange contracts to spend "the account wallet's pUSD and outcome tokens" (Wallets and authentication, read 5 November 2026).

Two more lines from the same page matter here. Deposit Wallets deployed after 29 June 2026 use a beacon proxy, "allowing Polymarket to send implementation upgrades without changing their addresses", and an owner who opts out "does not receive future security fixes, bug fixes, or features delivered through beacon upgrades". The pUSD page describes pUSD as "a standard ERC-20 wrapper that represents a USDC claim" on Polygon, says "no algorithmic peg, no fractional reserve", and says wrapping reverts if an admin has paused USDC.e, with redemption behind the same pause gate (Polymarket USD, read 5 November 2026).

The contracts page says "Polymarket's contracts have been reviewed by multiple independent security firms" and names Cantina, Quantstamp, Certora, SigmaPrime, Zellic and Pashov. The newest entries are Cantina and Quantstamp on version 1.2.0 and Certora on formal verification, all August 2026, and vulnerabilities can be reported through a Cantina bug bounty (Contracts, read 5 November 2026).

Polymarket's geoblock page sorts restrictions into tiers. "Block completely means no new orders and no closing of existing positions", and "close-only means users can close existing positions but cannot open new ones". It lists the United States as close-only on both the frontend and the API, along with the United Kingdom, France, Germany, Italy, Australia, Singapore and other places, and blocks Iran, Syria, Cuba, North Korea and three Ukrainian regions completely (Geoblock, read 5 November 2026).

Polymarket US is a different product. The CFTC's register lists QCX LLC, doing business as Polymarket US, as a designated contract market, with a designation date of 9 July 2025 (CFTC register, read 5 November 2026). Polymarket keeps its US documentation on its own site (Polymarket US docs, read 5 November 2026).

The full dated list for every platform, with a map, is on prediction markets by state.

Polymarket's position, as reported: prediction markets are governed federally, "not a patchwork of state rules" (KCTV5, read 5 November 2026), and in its New York filing it called the state's action "an extraordinary assertion of state power squarely foreclosed by federal law" (Al Jazeera, read 5 November 2026).

You call a coin up or down over 24 hours, the call settles against the real market price, and your hit rate lands on a public leaderboard. Nothing is staked and there is no payout, so it answers a different question from Polymarket: whether your read on the price is any good. As of November 5, 2026, 9,712 calls have settled and the crowd was right 49.1% of the time, against a 50% coin-flip baseline.

app.bitpredict.io/assets-market

More on Polymarket itself: the Polymarket review, Polymarket fees, Polymarket alternatives, Kalshi vs Polymarket and the live Polymarket odds. The no-money options side by side are on best prediction markets.