Polymarket briefly suspended trading on October 29 after a breach at a third-party service led to unauthorised withdrawals from user accounts. Blockchain analytics firm Bitquery traced around $2.73 million taken from 737 accounts within an hour, though Polymarket itself hasn’t confirmed total losses or how many customers were hit. Trading is back on its international platform, and the company has promised to reimburse anyone who lost money.
Users were already reporting missing balances before Polymarket switched its international exchange to cancel-only mode at 18:05 UTC. Existing orders could still be cancelled, but new trades and transactions through the platform’s relayer were paused while the company investigated. Polymarket said it had found and fixed the problem by 18:37 UTC, and its status page marked the incident resolved at 19:05 UTC, about an hour after the restrictions went on. Its separate US exchange wasn’t affected.
Polymarket confirmed an outside provider had been compromised without naming it publicly, and Reuters later identified the supplier as DebugBear, a UK-based service that tracks website performance and user experience. DebugBear acknowledged a security incident of its own and told customers using its Real User Monitoring product to pull its embedded JavaScript. Tools like that run inside customers’ websites, so a compromised script can reach visitors through a site they already trust.
Hudson Rock researchers found malicious JavaScript being served through DebugBear’s infrastructure, and BleepingComputer’s look at the code showed it went after people already logged into Polymarket. It checked their balances and open positions, then tried to sell their contracts or move their holdings to a wallet the attacker controlled, all using existing trading features rather than getting users to install anything themselves. How the attackers got hold of the supplier’s code in the first place hasn’t been made public.
Most of the withdrawals happened between 17:10 and 18:10 UTC on October 29, according to Bitquery, and they went through Polymarket’s own relayer with valid approvals instead of exploiting a broken smart contract. The stolen funds were swapped into POL, Polygon’s native token, and spread across more wallets, with some transfers starting to move toward Ethereum. Bitquery warned that its $2.73 million figure only covers traced transfers to one identified attacker address and may not capture every loss.
UK law enforcement has the case, after Polymarket referred it, and the company has promised to fully reimburse affected traders now that trading has resumed. It hasn’t said when that’ll happen, how claims will be assessed, or what its own verified loss figure is, and it hasn’t named the attackers. Its first statements confirmed the problem hit Polymarket.com, while the separate US exchange kept running normally.
Binance had a much larger breach on the same day, reporting an estimated $6.3 billion impact after attackers apparently got in through a compromised DevOps engineer’s laptop, though nothing so far connects the two incidents.
Polymarket has been here before, too, with this being its second reported security incident involving a compromised third-party provider in a matter of months. In June 2026, attackers injected malicious code into the platform’s website through a different outside supplier and took around $3 million from customers. The October breach again came through third-party software built into Polymarket’s site, even though the details of the two incidents differ, and the company hasn’t said what extra security measures it plans to bring in after this latest attack.