Polymarket halts trading and pledges reimbursements after third-party vendor breach
Polymarket temporarily halted trading on its international platform after a compromised third-party provider allowed attackers to drain an estimated $2.5 million to $2.7 million from user accounts.
Prediction market platform Polymarket briefly suspended trading on its international exchange on Thursday after a compromised third-party vendor exposed user accounts to unauthorized withdrawals. The platform placed its exchange into cancel-only mode and paused relayer actions at approximately 2:05 p.m. ET (18:05 UTC) as reports emerged on Discord and social media that users were having their account balances drained without authorization.[2][6][10][14][11]
Security firm Hudson Rock reported that a malicious script served from the servers of U.K.-based website analytics firm DebugBear checked for signed-in Polymarket users and attempted to dump or transfer their holdings. According to Quartz, attackers silently liquidated holdings across more than 900 transactions, draining about $2.5 million. Arkham intelligence data cited across reports showed a suspected attacker wallet holding roughly $2.65 million worth of POL after processing swaps from bridged USDC, while other estimates placed overall losses at up to $2.7 million.[2][3][4][9][12]
Prominent traders reported substantial losses during the breach, including a top trader known as Car who reportedly lost around $800,000, while an associate lost $600,000. Polymarket announced it resolved the issue on Polymarket.com, referred the breach to law enforcement, and resumed full trading around 3:00 p.m. ET. The company pledged that all impacted users will be fully reimbursed.[1][2][8][13][15]
Key facts
- Polymarket paused relayer operations and placed its international exchange in cancel-only mode around 18:05 UTC on October 29, 2026, following reports of drained user accounts.
- The breach stemmed from a compromise at third-party provider DebugBear, which served a script designed to detect logged-in users and transfer or dump their balances.
- Estimated user losses ranged between $2.5 million and $2.7 million, with Arkham data tracking roughly $2.65 million in POL in a suspected attacker wallet.
- Trader Car reported losing roughly $800,000, and a friend lost approximately $600,000 during the incident.
- Polymarket restored trading by approximately 3:05 p.m. ET, referred the incident to law enforcement, and committed to fully reimbursing affected traders.
Sources · 13 sources
- MT
MTS@MTSlivePost on X ·
SITUATION DETECTED: Polymarket․com has been hacked. A 3rd party provider was compromised, and Polymarket has referred the matter to authorities. Users reported assets being withdrawn without permission. Anyone impacted will be made whole.
Open source - UN
UnchainedArticle ·
Polymarket Resumes Trading, Vows to Reimburse Traders After Third-Party Provider Compromise Polymarket reopened trading on its international platform at about 3 p.m. ET on Thursday and said it will repay every trader who lost money after one of its third-party providers was compromised. Polymarket said in posts on X that trading was “fully back online” and that it is “fully reimbursing all affected traders.” The posts came from Polymarket Traders , a verified Polymarket account featuring its traders, and @Polymarket reposted the 3 p.m. update. Polymarket’s status page marked the incident resolved at 3:05 p.m. ET. The exchange was in cancel-only mode by 2:05 p.m. ET, with relayer actions paused, according to the status page. At 2:33 p.m., Polymarket wrote that it had fixed “an issue impacting our international platform” at Polymarket.com, that “one of our 3rd party providers was compromised” and that it had referred the matter to law enforcement. It said trading was halted “out of an abundance of caution” and that anyone affected “will be made whole.” A 2:54 p.m. post said trading would restart around 3 p.m. Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter . What Polymarket Hasn’t Disclosed Polymarket has not said how much was taken, how many accounts were hit or which provider was compromised. According to Arkham figures cited in news reports , the suspected attacker’s wallet held close to $2.65 million worth of POL. Security firm Hudson Rock counted roughly $2.19 million at a fallback address in the malicious code and called that figure unverified. Another news report put the loss at around $2.6 million, based on transaction records. Hudson Rock said a script served from DebugBear ‘s servers was built to find users signed in to Polymarket, check their holdings and then try to dump or transfer them. DebugBear, a U.K.-based analytics company, was aware of an “ongoing security incident” and told customers of its RUM product to remove its embed code, according to a news report . Separate From June’s Exploit Thursday’s incident is separate from a front-end exploit in June , when an unnamed vendor’s compromise let attackers inject code into Polymarket’s site. Bubblemaps estimated about $3 million was drained from fewer than 15 users, and Polymarket pledged to reimburse them. In May, a compromised private key let attackers drain about $700,000 from an internal wallet used for user rewards. Separately, Unchained reported Tuesday that the CFTC is investigating, per Reuters, whether Polymarket kept U.S. users off its offshore market as a 2022 settlement required. Why It Matters From what Polymarket and researchers have disclosed, all three incidents since May came through access points around Polymarket’s platform (a company wallet key, a vendor and now a third-party provider) and not through a reported flaw in its trading contracts. In June and again Thursday, Polymarket pledged the same day to reimburse affected users. Related Listen: How Did Hackers Take $388M From Bitget Without a User Withdrawal? The post Polymarket Resumes Trading, Vows to Reimburse Traders After Third-Party Provider Compromise appeared first on Unchained .
Open source - DE
DecryptArticle ·
Polymarket Pauses Trading as Prediction Market Investigates Security Incident Polymarket restricted trading and paused relayer actions as users report funds leaving their accounts. A suspected attacker wallet holds about $2.65 million in POL, per Arkham data.
Open source - BS
BSCN@BSCNewsPost on X ·
Polymarket halts trading after a third-party provider gets hacked @Polymarket put its international exchange in cancel-only mode today after users reported unauthorized withdrawals. The prediction market said one of its third-party providers had been compromised, referred the case to law enforcement, and promised to make every affected user whole. Arkham data puts the losses at about $2.65M, swapped into ethereum:0x455e53cbb86018ac2b8092fdcd39d8444affc3f6. Polymarket later said it fixed the issue and set trading to resume around 3pm ET. The breach hit its international platform, not its separate US exchange. It is the second attack through an outside vendor since June, when about $3M was taken.
Open source - TE
TechmemeArticle ·
Polymarket resumes trading after a security incident with a third-party provider, which a source says is DebugBear, and says it will reimburse affected traders (Reuters) Reuters : Polymarket resumes trading after a security incident with a third-party provider, which a source says is DebugBear, and says it will reimburse affected traders — Polymarket said on Thursday it had restored trading after a temporary halt prompted by a security incident involving a third-party provider …
Open source - SO
SolanaFloor@SolanaFloorPost on X ·
BREAKING: @Polymarket restricts trading to cancel-only mode and pauses relayer actions amid unconfirmed reports of user wallets being drained and a frontend compromise. https://t.co/VCxcR2EIBP
Open source - CO
Cointelegraph@CointelegraphPost on X ·
🚨 UPDATE: Polymarket says it has fixed an issue involving a compromised third-party provider and will make affected users whole, with trading temporarily halted as it works to restore the platform.
Open source - CN
crypto.news@cryptodotnewsPost on X ·
JUST IN: Polymarket is back online and trading has resumed after a brief halt due to a potential compromise One of their 3rd party providers was compromised, and they temporarily halted trading on their international platform with some users reporting their accounts have been drained.
Open source - CO
Cointelegraph@CointelegraphPost on X ·
🚨 JUST TODAY: • Polymarket: $2.7M reportedly stolen. • Binance: $5.7B reportedly drained in suspected hack. https://t.co/kRtrS59jff
Open source - AN
Aggr News@AggrNewsPost on X ·
POLYMARKET USERS REPORT THAT FRONTEND MAY BE COMPROMISED, AND ASSETS ARE BEING WITHDRAWN WITHOUT PERMISSION: DISCORD
Open source - SO
SolanaFloor@SolanaFloorPost on X ·
BREAKING: @Polymarket restricts trading to cancel-only mode amid reports of user wallets being drained and a frontend compromise. https://t.co/rOuF9Tinrv
Open source - QU
Quartz@qzPost on X ·
A third-party vendor bug let hackers drain $2.5M from Polymarket accounts Polymarket halted trading after a breach at website monitoring vendor DebugBear allowed attackers to silently liquidate user holdings across 900+ transactions. It's #Polymarket #DebugBear #CryptoSecurity https://t.co/QotsxbMvjA
Open source - CB
Crypto Banter@crypto_banterPost on X ·
🚨POLYMARKET USERS REPORT FRONTEND COMPROMISED, ASSETS WITHDRAWN WITHOUT PERMISSION! Multiple Polymarket users are reporting that the platform’s frontend may be compromised, with assets being withdrawn without their permission. One trader said their account was drained for ~$800,000, with another claiming a friend lost ~$600,000. Users are warning others not to interact with the site right now. An attacker address has also been shared: 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18
Open source - DE
Decrypt@DecryptMediaPost on X ·
Polymarket Puts Its Exchange in Cancel-Only Mode. Polymarket says its exchange is in cancel-only mode, with relayer actions paused while it investigates an incident. Its status page flagged a major outage on its trading API at 2:05 PM ET (18:05 UTC). https://t.co/TdmsQuQ2WS
Open source - KO
kook@KookCapitalLLCPost on X ·
polymarkets biggest trader car just got drained for $800k and his friend lost $600k..... no links clicked, no wallet connected, nothing the hole was on polymarkets side and the site is now in cancel only mode your funds are only as safe as the platform holding them https://t.co/6t93JkoBp0
Open source