Is Polymarket Legit After the 2026 Hacks?

Is Polymarket Legit or Just Well Funded

Polymarket is a legitimate, heavily funded operator. No published incident report documents a code bug exploited in its settlement contracts, and its international Terms cap liability at $100. Legitimacy alone does not insure user balances.

DropsTab lists nine funding rounds for Polymarket, eight with disclosed amounts totalling $3.88B. The backers section below breaks them down.

Funding is not a promise to users, though: the international Terms of Use, issued by Adventure One QSS under Panama law, disclaim compensation for hacking losses and cap liability at $100, and even the standard public disclaimer promises nothing.

Trading is risky. 100% loss can occur.

Even the contracts that settle trades leave one loss channel, ghost fills: an academic preprint (arXiv 2606.16852, v2, 10 October 2026) attributed 48.8% of the 2,037,304 settlements reverted on Polymarket's exchange from August 2025 to August 2026 to these attacks.

An attacker matches your order, then drains their own side before settlement, so the trade reverts and you lose the fill. No bug is involved, and none of those losses have been compensated.

Whether your deposit is safe depends on which Polymarket you use and how much of your balance sits in a logged-in browser session, not on whether the company is legitimate.

Which Polymarket Are You Using and Does It Pay Out

International, run by Adventure One QSS, keeps user funds in self-custody wallets on Polygon. Polymarket US, run by QCX LLC, is a CFTC-registered market holding custodial USD. The 29 October 2026 halt hit International only.

For a fuller side-by-side with Kalshi, see our Kalshi versus Polymarket comparison.

Polymarket International: your wallet, on-chain withdrawals

On International, collateral is pUSD, which unwraps to USDC, in wallets you control. The docs call on-chain withdrawals instant and free but warn that the unwrap pool can run dry and that transfers above $50,000 should be split, so a large balance may take more than one withdrawal.

International also carries the regulatory risk: on 27 October 2026 the CFTC was reported to be examining whether Polymarket breached its 2022 agreement to keep US users off International. Earlier probes closed in 2025 without charges, but a US user reaching International through a VPN is the most exposed account; state-by-state rules are in our legality guide.

Polymarket US: custodial dollars, bank-speed payouts

Polymarket bought its US licence outright: DropsTab's investor profile for Polymarket records the QCX acquisition on 21 July 2025 for $112M.

As a licensed exchange, Polymarket US holds customer dollars in a dedicated account, per its FAQ, and requires full KYC, including SSN, ID and selfie checks through Socure, which International does not.

Withdrawals return to the original payment method in 1 to 4 business days, and only for deposits that have fully cleared. That rule matters in practice: in February 2026 the payment processor Checkout.com flagged over 80% of Polymarket US deposit attempts as fraud after at least $10M in stolen-card deposits, and withdrawals slowed, the Wall Street Journal found.

Reddit threads describe withdrawals pending for weeks, and Trustpilot rates polymarket.com 1.3 out of 5 across about 660 reviews as of 6 November 2026. Such reviews show recurring complaints, not verified losses. Once funds are in, see how traders make money on Polymarket and how copy trading on Polymarket works.

Who Backs Polymarket and What That Money Does Not Cover

Real, concentrated capital argues against an exit scam. Polymarket has raised $3.88B across eight disclosed rounds, per DropsTab, most of it from ICE and 1789 Capital. None of it insures user balances.

Pre-money rose 17.5x in 607 days, from $1.2B in January 2025 to $21B in August 2026. DropsTab Research, as of 6 November 2026.

The two largest checks came from Intercontinental Exchange, which committed up to $2B on 7 October 2025 and added $600M in March 2026, and from 1789 Capital, lead of the $1B round, which the Wall Street Journal describes as Donald Trump Jr.'s fund. DropsTab marks ICE's March 2026 $600M round as inaccurate; without it, confirmed funding is about $3.28B.

Both backers are betting on the sector itself: prediction markets make up 80% of 1789 Capital's five recorded deals and 33.3% of ICE's six, against 8.6% for Founders Fund. Investors with that much riding on prediction markets have little reason to back an exit scam. Our prediction markets trend overview maps the wider field and the main Polymarket alternatives.

That capital protects the company, not your balance. The analyst JC Parets (@JC_ParetsX) pointed to money leaving the platform in August.

Assets under management at Polymarket are down 40% since the beginning of summer, as hundreds of millions of dollars have either left or been lost to gambling. The only people telling you how great prediction markets are always seem to be the ones getting paid to tell you that.

Outflows are not insolvency, though: International withdrawals are on-chain transfers anyone can verify, and none of the backers' money stands behind a user who loses funds to a hack.

Are Polymarket's Smart Contracts Safe

The three v1 contracts we checked on Etherscan are verified and not upgradeable, and no published incident report documents an exploited bug. Live V2 contracts can be upgraded through governance, which moves trust from the code to the operator.

On 6 November 2026 we checked three v1-era contracts on Etherscan: whether the source code is published, whether it can be swapped through a proxy, and which admin powers it carries.

On v1, an admin can pause trading, manage roles and set the fee receiver, and the exchange's published ABI on Polygonscan has no admin function that withdraws or sweeps user collateral. The cancel-only mode users saw on 29 October is an off-chain order setting. ChainSecurity audited v1.

New markets have run on V2 since 2 November, with the legacy stack running alongside. Polymarket's current contracts page lists CTF Exchange V2, the Neg Risk adapter and pUSD collateral, which we have not checked. The analyst account WorldOfMercek explained the reason for the handover on X in October.

With @Polymarket processing $4.97B in 30-day volume, its 2019 CTF foundation is becoming a constraint. Protocol V2 replaces that adapter-heavy stack with one position layer, $pUSD collateral, one exchange, and modular market infrastructure. …

In the thread's words, "The tradeoff is governance risk": V2 contracts can be upgraded through governance, so users rely on the operator not to change them against their interest. Six firms audited V2 in 2026.

Those audits cover code, not the website, keys or vendors, and every 2026 loss happened there, as the next section shows.

Polymarket Hacks in 2026 Sorted by the Layer They Hit

No 2026 hack exploited a bug in the settlement contracts. User losses came from vendor scripts on the website in June and on 29 October. The May drain took Polymarket's own money through a six-year-old key.

How to read the timeline below:

• Rows are layers from your browser to the chain, website scripts at the top and settlement contracts at the bottom.
• Dots are one-off incidents: green means users were repaid or promised a full refund, grey means no user funds were lost, and the dashed ring (December 2025) means nothing was announced.
• The red bar is ghost fills across the study's August 2025 to August 2026 window.

On 29 October, PeckShield flagged the website compromise as it happened, on X, and Polymarket confirmed the incident the same evening.

It seems @Polymarket UI may be compromised. Do NOT interact on the site for now.

The entry point was a vendor: CNBC named it as DebugBear, compromised through its domain registrar according to The Record. Its script created approvals inside victims' logged-in sessions, and seconds later Polymarket's relayer, which submits transactions so users pay no gas, used them to send every drain.

Bitquery's on-chain count shows $2.73M leaving 737 accounts in 985 withdrawals within an hour. The median account lost $171, and balance size was the only cap on what a live session could reach.

How to read the chart below:

• Circle area is proportional to dollars lost, and blue is the whole $2.73M from 737 accounts.
• The red ring is the four accounts above $100K, 43% of the total, and solid red is the largest verified loss, $358,369.
• The white speck, at the same scale, is the median loss of $171.

Trading resumed after about an hour, and both website incidents are logged in our crypto-hacks record.

Will Polymarket Reimburse You After a Hack

Often yes for hacks, always at Polymarket's discretion and on tightening terms. The Terms disclaim hacking compensation and cap liability at $100, and resolution disputes have gone unrefunded.

The Terms state the platform "will not be responsible for any compensation, reimbursement" for hacking losses, so every refund so far has been Polymarket's own decision, and the record runs from generous to nothing.

The October drain got the fullest answer: Polymarket says it returned $3.9M, the $2.7M stolen plus $1.2M for pause-related losses, but accounts above $10,000 had to sign a release with ID checks, and 95% of affected wallets were refunded by 1 November.

Earlier incidents got less: June's "in full" refund pledge was never independently confirmed, and nothing was announced for the December 2025 login breach.

Resolution disputes are judged case by case: Polymarket refused refunds after the disputed March 2025 Ukraine minerals market resolution, calling it "not a market failure", though it refunded Yes holders in the June 2024 Barron Trump market.

Part of the stolen money may also come back outside Polymarket's control. Polygon block producers, at Polymarket's and Binance's request, froze about 70.49M POL on attacker addresses, roughly 23.86M of it from the Polymarket incident. A proposal on Polygon's governance forum asks validators to approve a hard fork that moves those balances to recovery addresses named by Polymarket and Binance. It was on the agenda of the 5 November governance call, but as of 6 November no decision has been published and no activation block is set. Even after approval, the fork must first be rehearsed on the Amoy testnet, and forum replies question the precedent. A frozen balance is not a refund until the fork ships.

Who Decides If You Won on Polymarket

A vote of UMA token holders settles contested markets. The top nine wallets averaged 56.3% of vote weight across 489 UMA votes, per Bitquery, yet removing them would have changed zero outcomes. Ambiguous-rules markets carry the real resolution risk.

Anyone can propose an outcome by posting a bond, typically $750, inside a 2-hour challenge window. After two disputes a vote of UMA holders decides, and the whole path takes 4 to 6 days. Price-based markets settle from a data feed instead.

That vote is concentrated: the top nine wallets averaged 56.3% of vote weight across Bitquery's 489 UMA votes, and founders and early investors held 45.6% of UMA's starting supply in the genesis allocation we reconstructed on 6 November from DropsTab's vesting data for UMA. Today's vote weight can differ, and the token can still mint.

Removing the top nine wallets would not have flipped any of those 489 votes, yet concentration can still decide a result: the Ukraine minerals market, holding over $7M, resolved Yes in March 2025 with no deal signed, after a whale cast about 25% of the votes, per CoinDesk.

The bigger risk is rules that leave room for judgement: in June 2026 voters resolved No on whether Strategy would sell bitcoin in May, although its SEC 8-K filing showed a 32 BTC sale on 26 to 31 May. Galaxy, on the losing side, called a same-day clarification a retroactive rule change, and two traders have sued in New York state court; the case is pending.

UMA has started to narrow that risk: its managed-proposer whitelists cut incorrect proposals by 59% in their first month of enforcement, per UMA's own reporting.

Before buying, open the market's Rules tab and check that it names one resolution source and an exact deadline.

Is Polymarket Safe to Use Today and What to Check Before You Deposit

You cannot fix Polymarket's web layer. You can pick the platform, cap the balance a live session can reach and set alerts on outgoing transfers and approvals. Each step maps to a 2026 incident.

• Pick your platform first. For fiat and a US regulator with full KYC, use Polymarket US; for your own keys, use International with trading money only.
• Trade from a dedicated low-balance wallet. Keep idle funds off the platform. On 29 October, the balance in the session was the only limit on the drain.
• Read every signature prompt and revoke stale approvals with Revoke.cash. This contains June-style scripts but would not have stopped October's relayer withdrawals.
• Log out of polymarket.com when you are not trading. October's script worked only inside open browser sessions.
• Watch your deposit address in Drops Bot. Add your Polymarket deposit address, then set direction to OUT and the event to Approve; the free plan tracks 20 wallets from a public address, with no keys. An Approve or outgoing transfer you did not make means revoke and withdraw immediately.
• Skip markets with ambiguous rules and watch the ones you hold. Markets that turn on a judgement call, words like "announces" or "agrees", are the ones that went to a vote. The Polymarket module of Drops Bot tracks any market you hold, with alerts on a price change, a price target, large swaps and volume; the free plan covers 20 markets. Our Polymarket Telegram bot guide maps the monitoring tools, and Drops Odds, below, alerts on your markets.

How Do You Catch a Polymarket Dispute Early with Drops Odds

Drops Odds, the free Telegram bot from the DropsTab team, tracks live Polymarket odds and sends an alert when a market you hold moves, so a clarification, a dispute or a sudden odds shift reaches you the same day instead of at settlement.

Fake Polymarket Tokens and Airdrop Scams

There is no Polymarket token: DropsTab lists the coin as not yet trading, with only a waitlist and an airdrop on record, so every POLY claim site is fake, and the POLYMARKET ticker on Solana is a separate PreStocks instrument.

2026 drainers used exactly that angle, from a fake "Community Rewards" page to a malicious copytrading bot built to steal private keys. Polymarket staff never ask for seed phrases or login codes.