Polymarket halted trading on its international platform for close to an hour on Thursday 29 October after what it called a compromise of one of its third-party providers. Blockchain analytics firm Arkham traced about $2.65 million taken from users’ wallets to a suspected attacker address, according to crypto news site The Block, cited by NBC News. Polymarket says it will repay every affected trader. It has not said how many there are.
This Polymarket hack is the second since June in which users lost money through code the company says came from an outside supplier. In June, a malicious script served through its website by a compromised vendor drained about $3 million from the accounts of more than 11 victims, according to The Next Web. This time the intruders got in through software from DebugBear, a web analytics and performance monitoring tool, according to NBC, citing a person familiar with the details who spoke anonymously. Polymarket itself has not named the vendor.
The platform is one of the two giants of prediction markets, described on our Polymarket project page, and it was already under scrutiny this week for suspicious bets. The US platform did not appear to be affected, NBC reported.
One hour in cancel-only mode on 29 October
DebugBear itself said on X that it was dealing with an “ongoing security incident” from around 2 p.m. Eastern time, or 18:00 UTC, NBC reported. That statement, as reported, does not mention Polymarket, and Polymarket has not named DebugBear. The link between the two rests on NBC’s anonymous source.
At 18:05 UTC, Polymarket’s status page logged a major outage of its Predictions service and its Trading API, as BlockchainReporter also reported. The exchange went into cancel-only mode: traders could withdraw open orders but could not place new bets. Polymarket also paused its relayer, the service that takes the transactions users sign in the browser and submits them to the Polygon blockchain. “Relayer actions are paused while we investigate,” the company posted on X.
A minute later, at 18:06 UTC, Polymarket’s status account on X, Poly_Status, opened a thread with the same notice: the exchange was in cancel-only mode and relayer actions were paused while the team investigated “an incident”. At that stage the post spoke only of an outage, with no mention of a breach.
The explanation came at 18:37 UTC in an update on the status page, which NBC also quoted from Polymarket’s posts: “One of our third party providers was compromised, and we have referred this to relevant law enforcement.” The same update said the issue had been “identified and fixed” on Polymarket.com and that “out of an abundance of caution” trading stayed halted while the team brought the platform back. Polymarket said the attack appeared to originate in the United Kingdom and referred the case to British police.
At 18:55 UTC the status page announced that trading would resume at about 3 p.m. ET, and the incident was marked resolved at 19:05 UTC, an hour after the outage began. NBC also reports that trading restarted at 3 p.m. ET. A BlockchainReporter article published later that day still described cancel-only mode, but Polymarket’s own log shows the halt ending at 19:05 UTC.
About $2.65 million taken, and no count of victims
The only loss figure so far is Arkham’s, reported by The Block and repeated by NBC: about $2.65 million siphoned from users’ wallets. A Polymarket representative declined to comment on that number or on the exact nature of the attack. In its public posts the company did not confirm that users had lost money, but it said that “anyone who has been impacted will be made whole”.
Arkham attributed to the suspected attacker the address 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18, which held about $2.65 million in POL, the native token of Polygon, after a series of swaps from USDC.e to POL routed through the Relay protocol, according to BlockchainReporter. The funds were later moved to other addresses. When we checked the address on Polygonscan on the morning of 30 October, it held almost nothing: a fraction of a POL and about 11 USDC.e. Its 39 transactions all fall on 29 October, between about 17:50 and 18:55 UTC by the explorer’s timestamps. The first ones, from 17:50 to 17:56 UTC, are transfers through Polymarket’s Conditional Tokens contract, the contract that holds traders’ positions. That is about ten minutes before the first public alerts.
Nobody outside the company knows how many traders were hit. Unconfirmed reports on Polymarket’s Discord described drained wallets, NBC said. One trader posting as CarOnPolymarket said they lost $800,000 and that a friend lost about $600,000, according to BlockchainReporter. If those two claims hold, they alone account for $1.4 million, a little over half of Arkham’s total. Neither has been confirmed by Polymarket.
How the script went after logged-in traders, according to Hudson Rock
The most detailed account of the mechanism comes from security firm Hudson Rock, as reported by BlockchainReporter. We could not read Hudson Rock’s own analysis, so the description below is secondhand. According to that report, a script loaded from the outside provider searched the page for a logged-in user’s trading session, tried to sell that user’s positions and then to transfer the proceeds. The same attacker wallet was written into the script as a fallback recipient.
Performance monitoring tools work by placing a small piece of JavaScript on a client’s pages to measure load times and errors. That script runs inside the visitor’s browser with the same access as the site’s own code. If someone tampers with it at the source, every site that loads it serves the tampered version, without its own servers being touched. Security researchers call this a client-side supply-chain attack.
That is why the attack did not need anyone’s seed phrase or private key. A trader who was logged in and had the page open was enough, if the Hudson Rock account is right. BlockchainReporter says Polymarket’s core contracts were not breached. Our explainer on where crypto hacks really happen covers why the website and the wallet, not the chain itself, are where most money is lost.
Much is still unknown. DebugBear has not confirmed that its software was the way in, as NBC’s source says. Nobody has said how the provider was compromised, which other websites loaded the same script, or whether it was still being served after the alert.
The second vendor exploit since June, and the third loss of 2026
Thursday’s incident looks a lot like the one of 25 June. Then, a third-party vendor’s code was tampered with and a malicious script reached some users through Polymarket’s front end, The Next Web reported. PeckShield estimated losses at about $3 million in pUSD, Polymarket’s dollar token; the attacker bridged the funds from Polygon to Ethereum and swapped them for about 1,893 ETH. Polymarket did not name that vendor either, and it refunded the victims in full.
A month earlier, on 22 May, the problem was inside the house. An attacker drained a Polymarket address on Polygon that the company described as a wallet used for internal top-up operations. Investigator ZachXBT spotted it when about $520,000 was gone; the total reached about $700,000. Polymarket’s vice president of engineering said the key was six years old, according to Web3 Is Going Just Great.
And in December 2025, several users reported login attempts followed by closed positions and empty balances. Polymarket blamed “a vulnerability introduced by a third-party authentication provider”, which it did not name, according to The Block.
| Date | What failed | Reported loss | Accounts hit |
|---|---|---|---|
| December 2025 | Third-party login provider (unnamed) | Not disclosed | “A small number of users” |
| 22 May 2026 | Private key of an internal top-up wallet | About $700,000 | Company wallet |
| 25 June 2026 | Script from a compromised vendor (unnamed) | About $3 million (PeckShield) | Fewer than 15 |
| 29 October 2026 | Third-party script (DebugBear, per an NBC source) | About $2.65 million (Arkham) | Not disclosed |
Three of these four cases went through software Polymarket did not write. The last two follow the same pattern: a script loaded into the trading pages, not a flaw in the smart contracts.
Refunds pledged, not yet paid
“We’ll make this right and are fully reimbursing all affected traders,” Polymarket said in a later post, quoted by NBC. As of BlockchainReporter’s report, no refund had been confirmed, and the company had not said how compensation would be calculated or when it would arrive. The June precedent works in users’ favour, since those losses were reimbursed.
Polymarket is not the only prediction platform promising refunds this week. Two days earlier, Predict.fun pledged to repay users after about 400,000 USDT left their wallets.
What the outage means for Polymarket and its traders
Polymarket was valued at $21 billion in September after investors led by Donald Trump Jr. put in $1 billion, and it handles about $200 million of trading a day, according to NBC. A one-hour halt is a small slice of that volume. The bigger cost is trust: three losses in about five months, two of them through outside code, on a platform that asks users to keep money on its site to bet.
The timing is awkward. The company said this week it had looked into “dozens” of suspicious midterm bets, and Bloomberg reported it was investigating bets tied to Israel’s elections. Prediction markets are also at the centre of a fight between US states and the federal government over who regulates them, sharpened by Utah’s criminal charges against Kalshi and its founders.
For traders on the international site, what is known is limited. The script, as described by Hudson Rock, targeted users with an open, logged-in session, so anyone who used Polymarket.com around 18:00 UTC on 29 October will want to compare their order history and balances with what they expect. Polymarket has not said whether affected users must file a claim or will be contacted, as it did in June.
What to watch next
The next facts should come from four places. DebugBear has yet to publish an account of what happened and which customers were exposed. Hudson Rock’s own write-up would confirm or correct the secondhand description of the script. Polymarket owes users a post-mortem, a victim count and a refund date. British police, to whom the case was referred, have said nothing in public so far.
On-chain, investigators will follow the POL that left the attacker address on 29 October. The other open question is a design one: whether Polymarket keeps third-party scripts on pages where users trade with real money, after two incidents in which that is how the money left.