Image: Wikimedia Commons — Polymarket logo (official logo)
TL;DR — Polymarket halted trading on its international platform on Thursday, 29 October 2026, after users reported funds being drained from their accounts without permission. The company says a third-party provider was compromised, the issue has been fixed, and every affected trader will be reimbursed in full. Around $2.5–2.7 million was taken, according to wallet-tracking estimates.
UPDATE — 3 November 2026: refunds nearly complete, and how the hijacked script worked. By 30 October, 689 of the 726 affected wallets had been refunded in full, with the rest being verified, according to The Hacker News — and Polymarket separately paid $1.19 million to about 5,500 wallets that lost money during the trading pause, bringing total returns to about $3.9 million. Researchers at Hudson Rock, who downloaded the suspicious file twice and found identical malicious code both times, say the poisoned DebugBear script was a wallet-draining payload of about 15,187 bytes: it read account information Polymarket keeps in the browser, located the site's existing trading client and transaction signer, and used the permissions of an already-logged-in session — transactions authorised through the platform's own signing mechanisms (EIP-712 signatures and the relayer service) — so the smart contracts processed them as legitimate actions. Hudson Rock found no routine in the examined sample that stole passwords, seed phrases or private keys: this was session misuse, not key theft. DebugBear said its DNS records were compromised through its domain registrar, and that a different server answered for its web addresses while the malicious file was live; when The Hacker News checked on 1 November, the address that had served the malicious file, cdn.debugbear.com, had no DNS record at all. This is also the second frontend-compromise loss for Polymarket users in recent months — a similar attack through another vendor in June 2026 cost traders about $3 million, with no evidence linking the two incidents to the same attacker. Sources: The Hacker News (1 Nov 2026), CCN (30 Oct 2026), Forklog (30 Oct 2026).
📌 KEY HIGHLIGHTS
- Polymarket paused trading on its international platform after users reported unauthorised withdrawals on 29 October 2026.
- The breach came through a compromised third-party provider — performance-monitoring vendor DebugBear — not Polymarket's own trading engine, according to the company.
- Wallet trackers put the haul at roughly $2.5–2.7 million, moved in more than 900 transactions; Polymarket has not confirmed a total.
- Trading was halted, then restored the same day, and Polymarket says all affected users will be "made whole".
- The US exchange kept operating normally during the incident.
What happened?
On Thursday, 29 October 2026, Polymarket users began reporting on X that money was disappearing from their accounts without their permission. One trader said he had been drained of $800,000, and that a friend had lost around $600,000. Polymarket quickly put its international exchange into cancel-only mode — users could cancel open orders but could not place new trades — and paused relayer actions, the system that submits users' signed transactions to the blockchain.
Polymarket then confirmed the cause: one of its third-party providers had been compromised. "We've identified & fixed an issue impacting our international platform, Polymarket.com. One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement," the company said on X. "Anyone who has been impacted will be made whole."
The provider was identified in reporting as DebugBear, a UK-based website performance-monitoring company. DebugBear said on X that it had been "impacted by an ongoing security incident" and advised customers using one of its products to remove the embed code from their websites. According to security researchers cited by Decrypt and The Block, a DebugBear-hosted script containing wallet-draining code was injected into Polymarket's website, hijacking the trading front end to push unauthorised transfers.
How much was taken?
Polymarket has not confirmed a total loss figure, and estimates from blockchain trackers vary slightly — but they all land in the same range:
| Measure | Figure | Source |
|---|---|---|
| Suspected attacker wallet balance | More than $2.5 million, across 900+ transactions | Wall Street Journal review of wallet activity |
| Suspected attacker wallet in POL tokens | About $2.65 million | Arkham data, via The Block / Decrypt |
| Withdrawals across wallets | More than $2.7 million across 710 wallets | Betting Intelligence / Polysights data, via CNBC |
| Trading status | Halted, then restored at 3 PM ET on 29 October | Polymarket / CNBC |
Illustrative image: cryptocurrency trading setup. Image: Tugay Kocatürk / Pexels
Why it matters for World readers
Polymarket is one of the world's largest prediction markets, where users trade on the outcomes of elections, sports, finance and news events, with markets settled in crypto on the Polygon blockchain. The incident is a supply-chain attack — the weakness was not in Polymarket's core trading system but in a small vendor's script embedded in its website, which then had the run of users' browser sessions. That pattern is becoming a recurring risk for every platform that loads third-party code into its pages.
It is also the second time in months that Polymarket users have lost money this way: in June 2026, another third-party vendor breach saw about $3 million taken from users, with Polymarket again promising refunds. The repeat raises obvious questions about how the platform vets and monitors the outside code running on its site — and it lands days before the US midterm elections on 3 November, when prediction-market activity is expected to surge.
Should you care? ✅ / ⏳
Verdict: ✅ Act if you trade on Polymarket; everyone else, take note. If you hold funds on Polymarket's international platform, check your account activity now and watch for Polymarket's reimbursement process. If you use any crypto platform, this is a reminder that even a trusted site can be undermined by one compromised vendor script — and that keeping large balances on any single platform carries real risk.
What Polymarket users should do now
- Check your Polymarket account and wallet activity for any transaction you did not authorise.
- Do not re-approve or re-connect wallet permissions on the site until you are sure the incident is fully resolved — and beware of phishing messages pretending to offer refunds.
- If you were affected, keep records of the transactions: Polymarket says affected traders will be fully reimbursed, but has not yet detailed the claims process.
- Consider moving funds you are not actively trading off the platform until Polymarket explains what vendor safeguards will change.
FAQs
Was Polymarket itself hacked? Polymarket says a third-party provider was compromised, not its own core systems. The malicious code came through vendor DebugBear's script embedded in Polymarket's website, according to researchers and reporting.
How much money was stolen in the Polymarket hack? Polymarket has not confirmed a total. Independent wallet trackers estimate roughly $2.5–2.7 million, with the suspected attacker's wallet holding about $2.65 million in POL tokens after swapping stolen stablecoins.
Will affected Polymarket users get their money back? Yes, according to Polymarket: "Anyone who has been impacted will be made whole," and the company later said it is "fully reimbursing all affected traders". The exact claims process has not yet been detailed.
Was the US Polymarket exchange affected? No. Polymarket's US-based platform continued operating normally during the incident; only the international platform, Polymarket.com, was hit.
TAKEAWAY: A single compromised vendor script drained millions from Polymarket users and halted trading for hours — but the platform fixed it the same day and has promised full refunds. The open question is what changes so it does not happen a third time.
Follow World Tech on TechByCountry for tomorrow's update.
📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.
Sources
- Wall Street Journal — Polymarket Pauses Trading After Some Users Report Funds Drained
- CoinDesk — Polymarket suspends trading after third-party breach leads to user losses
- The Block — Polymarket pauses trading after $2.65 million exploit
- Decrypt — Polymarket Pauses Trading as Prediction Market Investigates Security Incident
Related on TechByCountry: SBI customer data leak: what customers should do, Volt Typhoon Silent Train zero-day attacks explained, FCC bans Chinese labs from testing US electronics.
Comments
Post a Comment