Polymarket paused trading on its international platform on October 29, 2026, after saying one of its third-party providers had been compromised. Trading came back at about 3:00 p.m. ET the same day. The Polymarket security breach, as several outlets framed it, is now a live test of how a large prediction market handles a vendor failure in public.
Third-party vendor incidents have been a steady theme this autumn. Our earlier look at the Coinbase Amplitude incident showed how contact and transaction data can leak through an analytics vendor without touching customer funds. The Polymarket case differs on the one point that matters most to traders. The Information and Wired both reported that users said money left their accounts before the halt.
This analysis separates what Polymarket has confirmed from what outlets have reported but nobody has verified. It also covers the technical pattern behind the incident, how it compares with other recent third-party failures, and what traders and security teams should do next.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Polymarket Security Breach: What Happened on October 29
The sequence is short. Users began reporting problems on the international site, Polymarket.com. The company halted trading, said it was working on the problem, and then announced a fix. By mid-afternoon Eastern time, the market was open again.
BNO News, which tracked the incident as it unfolded, quoted Polymarket’s statement on the cause: “We’ve identified & fixed an issue impacting our international platform, Polymarket.com. One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement.” That single sentence carries three confirmed facts. The problem sat on the international platform, the root cause was a vendor and not Polymarket’s own core systems, and the case is now with the authorities.
Headlines varied in tone. AP’s headline stressed a security issue and a paused international platform. The Information wrote that Polymarket halted some trading after users reported hacks. Wired went further and said hackers drained accounts. CNBC’s headline said some user funds were stolen and that the matter was referred to UK authorities, while Polymarket’s own wording, as quoted above, refers only to relevant law enforcement. When the company’s words and a headline differ, this article follows the company’s words.
One more point on scope. The company said the issue affected the international platform. Reporting said Polymarket US was not touched, but the statements cited so far do not establish that directly. Treat the US question as open until Polymarket says it plainly.
Polymarket Trading Resumed: The 3:00 p.m. ET Restart
Polymarket trading resumed at approximately 3:00 p.m. ET on October 29. The halt itself came with a short explanation. NBC News reported the company’s first message: “Out of an abundance of caution, we have temporarily halted trading & are working to bring the platform back online.” That wording frames the stop as a precaution, which is standard crisis language. It also signals that the team already suspected a live threat and chose to cut off trading while it investigated.
The restart message was more pointed. In the same NBC News coverage, Polymarket said: “We’ll make this right and are fully reimbursing all affected traders.” The line does two jobs. It tells users their balances are the company’s problem, and it tells the market that the platform considers the incident closed enough to reopen.
A fast restart carries risk. Reopening before every wallet is audited can mean a second wave of losses if the attacker still holds access. Polymarket has not published a forensic timeline, so outsiders cannot judge how thoroughly the vendor connection was cut. What the public record shows is a halt, a stated fix, and a restart within the same trading day.
Prediction markets also have a unique clock problem. Contracts tied to live events keep moving, and a frozen order book can distort prices once it thaws. Traders who held positions during the halt could not adjust them, and the company has not said whether it will treat any of those positions differently. Expect that question to surface in support channels over the coming days.
Polymarket Reimbursement: What Traders Were Promised
The Polymarket reimbursement pledge is the part of the story most users care about. Forbes ran with the angle in its headline, saying Polymarket was fully reimbursing traders after discovering a compromised third-party provider. Unchained’s headline said the company vows to reimburse traders as trading resumed.
Polymarket’s own statement added a second commitment: “Anyone who has been impacted will be made whole.” Those words are broad. They cover every affected trader, not only those above some loss threshold. They also say nothing about timing, method, or currency. Will users get stablecoins back in their wallets, credits inside the platform, or a manual claim process? None of that is on the record.
The missing details matter because a pledge is not a payout. A trader who lost funds on October 29 still needs three things: confirmation that the loss was recorded, a date, and a channel for disputes. Until Polymarket publishes them, the reimbursement stays a promise. Reports estimate the loss at roughly $2.6 million to $2.7 million, but Polymarket has not confirmed that figure, so even the size of the bill is unverified.
For a company of Polymarket’s profile, covering a loss in that reported range is plausible. The harder cost is trust. Users who rely on the international site to hold funds between trades now know a vendor script can sit between them and their wallets. A clean, quick payout would blunt that. A slow one would hand rivals a marketing line.
Confirmed Facts Versus Unconfirmed Reports
Breaking incidents breed mixed signals, and this one is no exception. The table below sorts the claims in circulation by how well they are supported. Confirmed means Polymarket said it in a statement quoted by news outlets. Unconfirmed means outlets reported it, but the company has not verified it.
| Claim | Status | Where it comes from |
|---|---|---|
| Trading halted on the international platform | Confirmed | Polymarket statement, covered by AP and NBC News |
| A third-party provider was compromised | Confirmed | Polymarket statement quoted by BNO News |
| Trading resumed around 3:00 p.m. ET on Oct. 29 | Confirmed | Outlet reports of the restart |
| Full reimbursement for affected traders | Confirmed (pledge only) | Polymarket statement, covered by Forbes and Unchained |
| Incident referred to relevant law enforcement | Confirmed | Polymarket statement quoted by BNO News |
| Provider is DebugBear | Unconfirmed | Reports citing a person familiar, not Polymarket |
| Losses of about $2.6 to $2.7 million | Unconfirmed | Blockchain-analysis reporting, including Bitcoin.com |
| About 700 users affected | Unconfirmed | Outside estimates, no company figure |
| Polymarket US not affected | Unconfirmed | Reporting says so, company statements do not establish it |
| Reimbursement timeline | Unknown | Not disclosed |
Read the table from the bottom up. The most useful numbers for traders, the exact count of victims and the payout date, sit in the unknown column. The best-sourced items are the ones that cost Polymarket nothing to say.
The DebugBear Question: How a Monitoring Vendor Becomes a Wallet Risk
Polymarket has not named the compromised provider. Reports identified it as DebugBear, a website-performance monitoring platform, but those reports rest on a person familiar with the matter, not on an official statement. No company confirmation exists. Until one does, the name remains an allegation about a vendor, and this article treats it that way.
Why a monitoring tool touches money
Performance and analytics tools usually work by loading code into the pages they watch. That code runs with the same privileges as the site’s own scripts. If an attacker takes over the vendor’s delivery path, the injected code runs inside the user’s browser session, right next to the buttons that sign transactions. BleepingComputer’s headline described a crypto-draining script breach, which matches that pattern. The details of the actual mechanism have not been confirmed by Polymarket.
The trust gap in the vendor chain
Most security reviews focus on the platform’s own code, its smart contracts, and its cloud accounts. Vendor scripts get a lighter touch because they feel like plumbing. Yet the same web page that asks a user to approve a transaction may also load a dozen outside scripts. Each one is a door. When a platform lets a monitoring tool run on pages that handle wallet approvals, it hands that tool the power to change what the user sees and signs.
The identity side of vendor risk is just as real. Our coverage of the Okta-linked DHS leak showed attackers pointing at a single sign-on provider as the weak link for 41,000 staff. Different sector, same lesson: one outside service can sit upstream of thousands of accounts.
Reported Losses: $2.6 Million to $2.7 Million
Outside estimates of the theft cluster in a narrow band. Bitcoin.com’s headline put the loss at an estimated $2.7 million taken from users. Other reporting used figures near $2.6 million. Roughly 700 users appeared affected, according to the outside estimates in circulation. Polymarket has disclosed no total and no victim count.
Those numbers come from tracing wallet movements, which is useful but incomplete. Analysts can see where stolen assets flow, yet they cannot always tell which losses belong to one incident, which users lost funds in smaller side events, or which transfers were legitimate. That is why the range exists, and why the conservative reading is about $2.6 million to $2.7 million, unconfirmed.
Put against the size of a major trading venue, a loss of that scale is small. Put against an individual trader’s balance, it is not. If the estimates hold and about 700 users were hit, the average loss would run to a few thousand dollars per person. That figure is simple division on unconfirmed inputs, so treat it as a rough scale check and not as a finding.
The reimbursement math is straightforward for a funded company. The reputational math is harder. A loss in the low millions that gets repaid in full inside days becomes a footnote. The same loss repaid slowly, or only after public pressure, becomes the story people remember about the platform.
Why Third-Party Scripts Keep Breaking Crypto Front Ends
Attackers have been going after the web layer around crypto platforms for years, because the browser is where keys get used and approvals get signed. Several earlier cases follow the same shape. In December 2023, a compromised component in the Ledger Connect Kit library pushed malicious code to apps that relied on it. In February 2025, the Bybit theft ran through a compromised interface component tied to the Safe{Wallet} infrastructure. In 2024, the Polyfill.io domain takeover showed how a widely embedded outside script can turn hostile overnight.
These are background cases, and none of them is evidence about what happened at Polymarket. They matter for one reason: they show the attack path is established, cheap to try, and hard for users to spot. A page that looks normal can still be routing a signature somewhere else.
Cloud-side vendor failures follow a related path. Our report on the TiDB Cloud breach described attackers sitting on a stolen service account for 28 days before anyone cut them off. The Polymarket incident, by contrast, appears to have been caught and contained within a single day. Speed is the one clear point in the company’s favor so far.
The defensive tools for this class of attack exist. A strict Content Security Policy limits which domains can run code. Subresource Integrity pins a script to a known hash so a swapped file fails to load. Isolating wallet-approval pages from third-party tags removes the vendor from the danger zone entirely. Many platforms skip these controls because they break analytics and marketing tags. Incidents like this one change that trade-off.
Competitive Comparison: How Third-Party Incidents Stack Up
Comparing incidents helps show what is unusual about this one. The table uses only the headline figures from our own recent coverage and from the reporting on Polymarket. The incidents differ in kind, so read the numbers as context and not as a ranking of severity.
| Incident | Headline figure | Vector | Funds at stake |
|---|---|---|---|
| Polymarket (Oct. 29, 2026) | About $2.6M to $2.7M, about 700 users (unconfirmed) | Compromised third-party provider | Yes, reimbursement pledged |
| Bithumb, Daishin, Mirae Asset breach | 38,490 customers | Data breach | Customer data focus |
| Keystone wallet key theft | 18,835 devices | Stolen web authentication key | Hardware wallets face replacement |
| TiDB Cloud breach | 28 days of access | Stolen service account | Cloud data exposure |
| Coinbase Amplitude incident | No funds affected | Analytics vendor | Contact and transaction data |
| DHS Okta-linked leak | 41,000 staff | Single sign-on provider | Personnel records |
The Polymarket row stands out in one column. It is the only entry where the reporting says user money moved. The Bithumb and Daishin breach, which exposed 38,490 customers, centered on data. The Coinbase vendor case ended with no funds affected. That difference explains why the Polymarket story spread faster, and why the company chose a reimbursement pledge over a data-protection notice.
The Keystone key theft offers the closest parallel in kind, because a stolen credential reached into 18,835 devices and left owners facing replacement. In both cases a trust anchor outside the user’s control failed. In both cases the user could do almost nothing to prevent it.
Market Impact on Prediction Markets
Prediction markets sell a simple promise: put money on an outcome and trust the venue to hold it and pay out. A vendor failure that drains wallets attacks the second half of that promise directly. Competitors will notice. Kalshi, which our readers know from stories like the one on next-Bond odds on Kalshi, operates under a different regulatory setup, and its pitch leans on that structure. Expect rivals to restate their custody and vendor controls over the next few weeks.
There is no public data yet on how the halt affected Polymarket volume or user balances, and this article will not guess at it. What the record supports is narrower. A venue that halts, explains, restarts, and promises full repayment inside one day has followed the standard incident playbook. Whether users stay depends on the payout, not on the statement.
The promotional side of the sector may feel it too. Operators in the space compete hard on sign-up offers, and our comparison of prediction market promo codes shows how crowded that field has become. Security posture rarely appears in those comparisons. After October 29, a few users will start asking about it before they claim a bonus.
Regulators watch events like this closely. A theft on an international platform that also operates a US arm invites questions about whether controls are shared across the two. The reporting says the US platform was unaffected, but the company has not stated so directly, and a clear statement would close that gap quickly.
Defensive Checklist for Traders and Platform Teams
Users cannot fix a vendor compromise, yet they can shrink their exposure. Platform teams can do far more. The table pairs each risk with a practical control. It draws on general security practice, not on any claim about Polymarket’s setup. For more on this beat, see our cybersecurity coverage.
| Risk | Who acts | Practical control |
|---|---|---|
| Malicious script runs on a wallet-approval page | Platform | Strict Content Security Policy and Subresource Integrity on every outside script |
| Vendor tag has access to sensitive pages | Platform | Remove third-party tags from checkout, deposit, and approval screens |
| Vendor compromise goes unnoticed | Platform | Monitor script hashes and outbound network calls from the browser |
| Large balance parked on the platform | Trader | Keep only trading funds on the venue and withdraw the rest |
| Blind approval of a signature request | Trader | Read every prompt and reject anything that does not match the action taken |
| Delayed discovery of a drained account | Trader | Review balances and transaction history after any announced incident |
Traders on the international site should check their account history for October 29 and keep records. If Polymarket opens a claims process, screenshots and wallet addresses will speed it up. Watch for scam messages as well. Real incidents attract fake recovery emails and direct messages that ask for seed phrases. Polymarket has not announced any such request, and a real reimbursement should not need a private key.
Five Predictions for the Next 30 Days
These are analyst judgments based on how similar incidents have unfolded. They are not reported facts.
- Polymarket publishes a post-incident write-up. Companies that promise to make users whole usually follow with a timeline of what failed. Expect either a named vendor or a deliberate refusal to name one.
- Reimbursement lands in weeks, not months. The reported loss is small enough for the company to cover from its own funds. The open question is the method, so look for an announcement of a claims form or an automatic credit.
- The loss estimate moves. Early blockchain tracing rarely survives contact with the final tally. The $2.6 million to $2.7 million range could widen once the company counts victims.
- Rivals tighten script policies. Prediction markets and crypto exchanges will review which vendor tags run on sensitive pages. Some will drop analytics from approval flows altogether.
- No quick arrests. A law enforcement referral starts a slow process. Cross-border cases with on-chain laundering rarely produce public charges within a month.
What This Means for Security Teams
The practical takeaway for any team that runs a customer-facing web app is to inventory every outside script and ask what it could do if its owner were hijacked. Performance monitors, chat widgets, tag managers, and A/B testing tools all run with the page’s privileges. If one of them loads where money moves, it belongs on the risk register.
The Polymarket response also offers a template for communications. The company named the category of failure within hours, said the problem was fixed, referred it to law enforcement, and pledged full repayment. It held back the provider name and the numbers. That restraint is defensible while an investigation runs. It becomes a problem if the silence stretches for weeks.
Frequently Asked Questions
Did Polymarket confirm it was hacked?
Polymarket said one of its third-party providers was compromised and that the issue affected Polymarket.com. It did not use the word hack in the statements quoted here. Outlets including Wired and The Information reported that users said funds were drained.
When did Polymarket trading resume?
Trading resumed at approximately 3:00 p.m. ET on October 29, 2026, the same day the platform halted trading.
Will affected users get their money back?
Polymarket said it is fully reimbursing all affected traders and that anyone impacted will be made whole. The company has not published a timeline or a method, so the payout details remain unknown.
Which third-party provider was compromised?
Polymarket has not officially named the provider. Reports identified it as DebugBear, but that identification is unconfirmed and rests on a person familiar with the matter.
How much money was stolen?
Outside estimates run from about $2.6 million to $2.7 million, with about 700 users reportedly affected. Polymarket has not confirmed these totals, and the final figure may differ.
Was Polymarket US affected?
Reporting said the US platform was not affected. The statements cited by news outlets do not establish that directly, so the point is unconfirmed.
What should Polymarket users do now?
Review account activity for October 29, keep screenshots and wallet addresses, and withdraw funds you do not need on the platform. Never share a seed phrase or private key with anyone claiming to handle reimbursement. Follow Polymarket’s official channels for claim instructions.
