Polymarket Faces Hack Due to Order System Flaw

Polymarket, a prediction market platform, has been targeted by hackers exploiting a design flaw in its order system synchronization mechanism. According to ChainCatcher, the attackers manipulated the nonce to cancel or invalidate on-chain matched trades before they were finalized, while off-chain records remained valid. This discrepancy led to API errors affecting trading bots like Negrisk, resulting in user losses. The attack involved several steps: first, the attackers submitted or matched large reverse trades with market-making bots on Polymarket's off-chain order book. They then constructed transactions with forged or duplicate nonces or engaged in nonce competition on-chain, ensuring the on-chain transactions would revert. The Polymarket API prematurely reported a 'successful trade' to the bots before on-chain confirmation, causing the bots to believe their positions were hedged, although the actual on-chain status had not changed. Subsequently, the attackers executed real on-chain trades to exploit the exposed positions of the bots, profiting without risk. Since the reversion occurred at the chain level, Polymarket's fees did not escalate, keeping attack costs manageable and allowing continuous execution. GoPlus advises users to halt automated trading tools, verify on-chain transaction statuses, enhance wallet security, and closely monitor official announcements from Polymarket.