By Prediction market operator Polymarket has restored trading after a security breach on October 29, 2026, resulted in an estimated $2.7 million being stolen from hundreds of users of its international platform.
Blockchain intelligence firm Bitquery identified approximately $2.73 million in unauthorized withdrawals affecting 737 accounts within a one-hour period. Other investigators estimated losses between $2.5 million and $2.7 million. Polymarket confirmed that one of its third-party service providers had been compromised, allowing attackers to interfere with user transactions.
The company temporarily suspended trading, identified and fixed the issue, and referred the incident to law enforcement in the United Kingdom. Trading resumed approximately one hour after the initial suspension.
Polymarket pledged to reimburse affected customers fully, although it has not disclosed a final loss figure, confirmed the number of affected users or published a reimbursement timetable.
Compromised Monitoring Script Enabled Unauthorized Transactions
The incident began on October 29 when users reported that cryptocurrency balances and prediction market positions were being transferred or liquidated without authorization. At 18:05 UTC, Polymarket placed its international exchange in cancel-only mode, preventing new orders and trades while allowing existing orders to be canceled.
The platform also suspended relayer operations while investigating the suspicious activity. By 18:37 UTC, Polymarket announced that it had identified and corrected the vulnerability. Trading resumed at approximately 19:05 UTC.
Security researchers linked the intrusion to DebugBear, a website performance-monitoring company whose JavaScript tools were embedded in Polymarket’s website. DebugBear separately acknowledged a security incident and advised customers to remove its Real User Monitoring scripts.
Researchers at Hudson Rock identified malicious JavaScript distributed through the provider’s infrastructure. According to BleepingComputer’s technical analysis, the script targeted authenticated Polymarket sessions, examined account balances and attempted to execute unauthorized transactions.
Depending on the user’s authentication configuration, the malicious code could sell prediction market positions or transfer assets to attacker-controlled wallets. The attack exploited existing transaction functionality rather than a confirmed vulnerability in Polymarket’s underlying smart contracts.
The company has not published a complete technical post-mortem explaining how the third-party infrastructure was initially compromised.
Blockchain Investigators Trace $2.73 Million Across 737 Accounts
Bitquery’s investigation identified unauthorized withdrawals between 17:10 and 18:10 UTC on October 29. The firm estimated that 737 accounts lost approximately $2.73 million, including funds and positions transferred through Polymarket’s existing wallet infrastructure.
Its analysis found that stolen assets were converted into POL tokens and distributed across additional addresses. Some funds subsequently moved toward Ethereum through cross-chain bridging services. Separate analysis cited by The Block identified approximately $2.65 million associated with a suspected attacker wallet.
The different estimates reflect separate blockchain observations and should not be treated as additional losses. Bitquery also reported one further unauthorized withdrawal after Polymarket announced that it had identified and fixed the issue, raising questions about the timing of containment.
However, the company marked the incident resolved at 19:05 UTC, and no subsequent widespread compromise has been confirmed. The attack follows another third-party security incident in June 2026 that reportedly resulted in approximately $3 million in user losses.
Together, the incidents highlight the risks associated with external software integrated into cryptocurrency trading interfaces. Even when smart contracts remain secure, compromised browser scripts can potentially exploit authenticated sessions and existing transaction permissions.
Polymarket’s separate US-regulated exchange was not reported to have been affected. The latest incident also comes as the company faces renewed CFTC scrutiny concerning compliance with its 2022 settlement, although there is no established connection between the regulatory investigation and the security breach.
For affected traders, the immediate issue is receiving the reimbursements Polymarket has promised. For the platform, the longer-term challenge is demonstrating that third-party integrations and user transaction controls have been strengthened sufficiently to prevent similar attacks.