@thenestintern posted about a Polymarket frontend compromise at 2026-10-29T17:52:45Z, the first tracked post on the story this week.
[1]← Narrative indexOct 25 – Oct 31 UTC Every claim links to the posts behind it01 02 03 04 05 06 07 08 09 6 posts on X 1 week
Microtrend / Rank 17 / Week of Oct 25 – Oct 31
Polymarket frontend reportedly compromised: top trader @CarOnPolymarket says $800k drained, platform moves to cancel-only mode
Peak / day7tracked accounts
Peak dayThuOct 29 · busiest day in the panel
Rest of X / peak day—not measured outside the panel
Cited claims9source links retained
Market—no token attached
Attention
Who was talking, day by day
Tracked paneldistinct tracked accounts / day
What happened
On 2026-10-29, accounts reported that the Polymarket frontend was compromised: @liquidatedxxx relayed top trader @CarOnPolymarket saying his account was drained for $800k around 17:45 UTC and a friend lost $600k, with positions sold, and @aaalex (3,275 likes, 333k views) said the frontend was injecting a malicious script to sell positions and withdraw funds. @world_xyz reported the platform restricted trading to cancel-only mode and paused relayer actions. @liquidatedxxx noted the incident looked similar to a June frontend supply-chain attack, and @rinku_web3 later described it as a compromised third-party vendor introducing a malicious script, alongside a separate Binance security incident.
Why it matters
Polymarket is a major prediction-market venue, and a frontend/supply-chain compromise puts user wallets and open positions at risk and raises questions about third-party dependencies. The story also spread fast through large accounts, making it a test case for how unverified exploit reports get amplified before an official confirmation.
Observed reaction
Alarmed and warning-heavy: the largest account on the story, @aaalex (3,275 likes, 333k views), told users not to log in, revoke permissions and not interact. @world_xyz and @liquidatedxxx treated it as active and serious, while @adityaaa_sharma and @cryptowithkhan added mocking or shock framing. @rinku_web3 folded it into a broader 'security wake-up call' alongside a Binance incident.
Spread
Where it started and who carried it
- First seen
- Oct 29, 17:52 UTC by @thenestintern
- Accounts
- 3 tracked · 5 elsewhere on X
- Communities
- memecoins solana (1), prediction mkts (1), perps trading (1)
- Key accounts
- @aaalex, @adityaaa_sharma, @rinku_web3, @world_xyz, @cryptowithkhan
Explainability
Evidence register
@liquidatedxxx reported that top trader @CarOnPolymarket said his account was drained for $800k around 17:45 UTC and that a friend lost $600k, with positions sold and warnings not to interact with the site.
[1]@liquidatedxxx said the incident looked similar to a June frontend supply-chain attack.
[1]@blockstargram posted that the Polymarket frontend was compromised and users saw withdrawals they did not initiate.
[1]@aaalex alleged the Polymarket frontend was injecting a malicious script to sell positions and withdraw funds and told people not to interact, revoke permissions, or log in.
[1]@adityaaa_sharma posted 'Polymarket frontend hacked' and tied it to an @aravind post predicting a Polymarket crisis.
[1]@world_xyz reported the Polymarket frontend may be hacked, trading restricted to cancel-only mode and relayer actions paused, with reports of drained wallets.
[1]@cryptowithkhan posted that the Polymarket frontend was hacked and people lost millions.
[1]@rinku_web3 summarized a Binance security incident (DevOps employee laptop reportedly compromised, around $3B in assets reportedly frozen on-chain, deposits and withdrawals temporarily paused, SAFU fund coverage) alongside the Polymarket frontend exploit allegedly caused by a compromised third-party vendor introducing a malicious script.
[1]Angles
Formats in use
- Breaking-news text post
- Screenshot of another user's post
- Quote-tweet commentary
- Multi-incident bullet-list recap thread
Risks
- The compromise, the $800k/$600k losses and the malicious-script claim are unverified reports from accounts and must be labeled as unverified, not stated as confirmed facts.
- Do not repeat price-loss figures as established fact; attribute them to @CarOnPolymarket via @liquidatedxxx.
- Avoid financial advice or instructions that could read as a recommendation; security guidance should be framed as reporting what accounts said.
- The 'Aravind strikes again' framing by @adityaaa_sharma is opinion/speculation and should not be presented as evidence.
- The Binance incident in @rinku_web3's post is a separate story and mixing it into the headline could distort both; if used, keep clearly secondary.
Observed content
Most-engaged posts
Polymarket frontend compromised Hyperliquid invested by ICE HIP-4 coded?Open on X →
Possible Polymarket frontend compromise right now @CarOnPolymarket (top trader) just reported his account was drained for $800k around 17:45 UTC. A friend lost $600k. All his positions got sold. He advised everyone not to interact with the site. Discord and X are full of reportOpen on X →
🚨 BREAKING : Polymarket Frontend has been compromised and users have been witnessing withdrawals from their accounts without initiating the transactions. https://t.co/7imASs1asrOpen on X →
Polymarket frontend is injecting a malicious script to sell all your positions and withdraw funds Do not interact with Polymarket, revoke permissions, do not even log in https://t.co/Y0pSi5lvX6Open on X →
Polymarket frontend hacked. Aravind strikes again. https://t.co/YHF1W7BeC5Open on X →
Crypto had a brutal security wake-up call. 💀 Two major platforms. Two different security incidents. One big reminder: even the biggest names in crypto aren't immune to vulnerabilities. 🔴 Binance — Security Incident - A DevOps employee's laptop was reportedly compromised. - NOpen on X →
History