预测市场 Polymarket 国际平台 10 月 29 日遭第三方供应商入侵：约 260 万至 270 万美元流出，交易已恢复、承诺赔付受影响用户
预测市场平台 Polymarket 的国际平台 10 月 29 日发生一起独立的安全事件：第三方供应商遭到入侵，导致用户资金未经授权流出，链上追踪估计约 260 万至 270 万美元。这是与本站 10 月 30 日已刊币安 63 亿美元被盗案同日发生的另一事件，但目前没有已证实的证据表明两起事件存在关联，本篇只写 Polymarket 一案，不重复币安案的内容。
据 CoinDesk 10 月 30 日报道，Polymarket 于 10 月 29 日下午暂停国际平台交易，原因是黑客从用户账户中盗走逾 260 万美元。公司当天下午 2 时 05 分（美东时间）将交易置于仅可撤单模式并暂停交易中继，随后于 2 时 37 分表示已确认一家外部供应商遭到入侵、问题已修复、已移交执法部门，并承诺受影响用户将得到全额赔付；状态页于下午 3 时 05 分标记事件已解决，交易随后恢复。
链上分析机构的估计口径略有不同：早期追踪显示可疑地址在约 1 小时内收集约 268 万美元，另一家机构估计 737 个账户在 10 月 29 日下午 1 时 10 分至 2 时 10 分之间流出约 273 万美元。Polymarket 本身尚未公布最终损失总额与受影响用户数，上述数字均为追踪机构的初步估计、非公司定稿。公司说明称，此次事件涉及其国际平台，不应被理解为美国平台遭到入侵的证据；其智能合约未被触及，资金是通过被入侵的第三方脚本读取浏览器存储的登录参数与交易密钥后流出的。
对用户而言，关键区别在于赔付承诺仍在兑现过程中：公司称受影响者“将被全额赔付”，但恢复交易不等于每一笔余额已赔付完毕，后续以公司正式公告与执法调查为准。
Polymarket International Platform Hit by Vendor Breach on Oct. 29: About $2.6–2.7 Million Drained, Trading Restored, Users to Be Reimbursed
Prediction-market platform Polymarket's international platform suffered a security incident on October 29: a third-party vendor was compromised, allowing user funds to be drained without authorization. On-chain trackers estimate the outflow at roughly $2.6 million to $2.7 million. The incident is separate from the Binance theft reported the same day, and there is no confirmed evidence linking the two.
According to CoinDesk's October 30 report, Polymarket paused trading on its international platform on the afternoon of October 29 after hackers stole more than $2.6 million from user accounts. The company placed trading into cancel-only mode at 2:05 p.m. Eastern and suspended its trading relayer; at 2:37 p.m. it said an external vendor had been breached, the issue was fixed, the matter had been referred to law enforcement, and affected users would be fully reimbursed. Its status page marked the incident resolved at 3:05 p.m., and trading resumed.
On-chain estimates differ slightly: one tracker saw a suspicious address collect about $2.68 million within an hour, while another estimated about $2.73 million left 737 accounts between 1:10 p.m. and 2:10 p.m. on October 29. Polymarket has not published a final loss total. The company said the incident involved its international platform and should not be read as evidence that its U.S. platform was breached; its smart contracts were untouched, and funds were moved after the compromised third-party script read login credentials and trading keys stored in browsers. The reimbursement pledge is still being carried out, and final figures await the company's formal announcement and the law-enforcement investigation.
来源：GSM·美国（原文链接）
图片来源：图：加密货币交易示意。1924848uejdjfik 摄，Public domain，经 Wikimedia Commons。 / Cryptocurrency trading on a smartphone (illustrative). Photo by 1924848uejdjfik, Public domain, via Wikimedia Commons.
