Polymarket halts trading after third-party compromise; users report drained wallets

Left · 1Polymarket halted trading on its international platform, Polymarket.com, on Thursday 29 October for nearly an hour after what it said was a compromise of a third-party provider. 1 Mixed · 2Polymarket said it had identified and fixed the issue, had referred the matter to law enforcement, and that "anyone who has been impacted will be made whole". 1 2 Centre · 1BNO News reported that the problem was first noticed around 17:30 UTC (1:31 p.m. ET), when several users said their wallets had been "drained" after an unknown party sold all of their shares; it said it was unclear how many users were affected. 2

Centre · 1According to people monitoring the situation, cited by BNO News, code served from the analytics company DebugBear began delivering malicious code on Polymarket's site, which gathered information on active users and used trading credentials from their local storage. One user described it selling every open position at progressively worse prices and then swapping the balance to POL or USDC and sending it to the attacker. 2 Centre · 1DebugBear, which is based in the UK, said it was aware of an "ongoing security incident" and urged customers using its RUM product to remove the embed code. Polymarket itself did not name the provider in the statements quoted. 2 Mixed · 2The Washington Examiner, citing the Wall Street Journal, said the affected vendor was DebugBear, used to monitor performance on the trading platform, and that DebugBear said its software was "impacted by a security incident" involving its real user monitoring product. Wired said only that a UK-based vendor was breached, "not the prediction market’s website itself". 3 4

Mixed · 2The malicious code disappeared from the site at about 18:00 UTC (2 p.m. ET) when trading was suspended, and trading resumed at 3 p.m. ET. 2 1 Mixed · 2The scale of losses is not settled. BNO News said users reported losing hundreds of thousands of dollars and that it was unclear how much was stolen; NBC News said Polymarket had not confirmed users lost money, but cited The Block, which reported about $2.65 million siphoned, based on Arkham blockchain data. 2 1 Mixed · 2Other outlets put the figure higher or gave more detail: Wired, citing blockchain analytics firm Bubblemaps, said around 700 users appeared affected with approximately $2.7 million stolen, while the Washington Examiner said multiple reports found over $2.5 million siphoned through more than 900 transactions. Polymarket declined to tell Wired how many traders or how much money were involved. 4 3

Right · 1IJR reported that Polymarket placed the international exchange in cancel-only mode and paused relayer actions, and that blockchain data showed a suspected attacker holding about $2.65 million in POL, a figure the platform did not confirm as total losses. 5 Left · 1In a later post on X, Polymarket said it was "fully reimbursing all affected traders". NBC News reported that its U.S.-based platform did not appear to be affected. 1 Left · 1NBC News added context: it called vendor compromise a common route for attackers but said theft from users makes this a significant breach, and noted Polymarket was valued at $21 billion in September after a group led by Donald Trump Jr. invested $1 billion. It also noted the platform faces a dispute between U.S. states and the Trump administration over regulation, and insider-trading probes. 1

Mixed · 2Wired and the Washington Examiner noted earlier security problems: Wired said a June 2026 breach caused over $2 million in losses, while the Washington Examiner said users lost a combined $3.1 million in a June phishing attack involving code inserted into frontend software. Wired also reported that the flagship platform is crypto-based and banned in the United States, and that Polymarket raised $1 billion in a round led by 1789 Capital, where Donald Trump Jr. is a partner; it dates the round to August, whereas NBC News dates the $21 billion valuation to September. 4 3