Home · Business · Oct 29 archive
Polymarket Restores Trading After $2.65M Security Breach
· Confirmed
In Short: Polymarket restored trading operations Thursday after resolving a security incident that compromised $2.65 million in user funds.
Polymarket restored trading operations Thursday after resolving a security incident that compromised $2.65 million in user funds. The breach occurred when a malicious script, injected through a compromised third-party vendor, drained user wallets.
The incident, which began at 18:33 UTC, affected the global domain Polymarket.com but did not impact institutional operations or regulated divisions. Polymarket’s engineering team immediately removed the external dependency from its production build.
The root cause of the attack was the compromise of a third-party real user monitoring (RUM) software provider, identified by security researchers as DebugBear. The script supplied by the third-party vendor contained altered JavaScript code that acted as a wallet drainer.
According to Bubblemaps, approximately 700 users were affected, with an estimated $2.7 million reported as stolen. Polymarket clarified that its underlying smart contracts deployed on the Polygon network suffered no code vulnerabilities.
In a statement posted to its Polymarket Traders account on X at 19:00 UTC, Polymarket said, “Trading is now fully back online. We’ll make this right and are fully reimbursing all affected traders.”
The company has pledged to fully reimburse all affected traders and has referred the incident to UK law enforcement. Polymarket’s commitment to reimbursement addresses the immediate financial consequences, although the company has not provided a complete public accounting of the losses or a detailed reimbursement timetable.
Trading restoration and a full-reimbursement pledge reduce immediate uncertainty, but the final cost depends on verified losses, the number of affected users, and the completion of the compensation process.
This incident raises questions about how external software dependencies can expose cryptocurrency users to financial losses even when there is no confirmed exploit of the platform’s core smart contracts.
In June 2026, the platform faced a similar breach that led to over $2 million in losses for traders impacted at that time.
Jeremy, an X user, alleged that attackers compromised Polymarket’s frontend, leading to unauthorized wallet withdrawals, including a reported $2.68 million in suspicious transfers.
Polymarket’s status page shows that the platform allows order cancellations but blocks new trades. The company initially restricted its exchange to cancel-only mode, allowing customers to withdraw existing orders while new trades stopped processing.
Trading was fully restored by 19:05 UTC, with the Predictions Trading API, also known as CLOB, declared resolved.
Background
Polymarket resumed trading operations Thursday after a security breach that affected nearly $2.65 million in user funds.
What's confirmed
- The company said it had identified and fixed the issue, referred the incident to law enforcement and would compensate affected users.
- Polymarket subsequently said it had identified and fixed the issue, confirmed that one of its third-party providers had been compromised and referred the incident to UK law enforcement.
- Prediction markets platform Polymarket was forced to halt trading on its international platform Thursday for nearly an hour because of what it said was a compromise of third-party software.
- Polymarket pledged to fully reimburse all affected traders. 6 outlets told this the same way.
- Bithumb reported a breach of its internal employee system as South Korean financial firms faced cyberattacks, according to Yonhap News Agency.
- A later update from their Polymarket Traders account confirmed trading was now fully back online.
- Polymarket has suspended new trading on its international platform after a third-party provider suffered a security breach.
- Hackers broke into gambling “prediction market” site Polymarket’s international exchange and stole an undisclosed amount of user funds, CNBC reported on Thursday, with one source telling the network that the incident originated with UK-based web performance monitoring firm and Polymarket vendor DebugBear.
What's still developing
- Polymarket Rocked by Massive Hack as Nearly 1,000 Accounts Lose $2.6 Million Polymarket faced a serious security breach this Thursday on its web interface after a malicious script injected through a third-party vendor compromised user wallets, draining Chainlink Launches Weekend Tokenized Asset Feeds Powered By Perpetual Futures TL;DR Chainlink launched a service that provides reference prices for tokenized assets during weekends and holidays.
- Kalshi reached approximately zkLink Nova Bridge Loses $786K in Forged Root Exploit Blockchain security firm Blockaid detected an ongoing exploit against zkLink Nova’s bridge on Ethereum, reporting that an attacker used a public relayer to inject a Predict.fun Suffers $400K USDT Breach, Promises to Refund Affected Users TL;DR: Predict.fun confirmed unauthorized transfers totaling approximately 400,000 USDT originating from user wallets.
- In another case involving a third-party provider, Pepperstone disclosed a client data breach but said trading accounts, passwords and bank details were unaffected.
- Bitget has resumed Bitcoin (BTC) withdrawals after a security breach affecting nearly $388 million.
- One day earlier, our coverage of the Coinbase Amplitude third-party incident on Oct. 28 showed a vendor problem that exposed contact data while hitting zero funds.
- It also paused the service that submits transactions on behalf of the users.
- According to their analysis, malicious code accessed users’ trading sessions and initiated actions that moved assets from their accounts.
- Polymarket said it had identified and fixed the vulnerability, adding that it had referred the matter to law enforcement in the United Kingdom, where DebugBear is based.
- Eastern time and paused trading on its international platform as a precaution.
- The diagram seen showed 712 deposit wallets and about $2.71 millio n moving through the main route.
- However, reports of unauthorized withdrawals have raised concerns about the safety of user funds.