Polymarket Exploit: Trading Resumes After $2.65M Third-Party Breach

The Polymarket exploit that hit the prediction market on Thursday, October 29, 2026, cost users more than $2.5 million within minutes. Estimates of the total range from about $2.65 million to $2.7 million. The platform put its exchange into cancel-only mode and reopened trading about an hour later. The Block reported that Polymarket said a third-party provider had been compromised.

• Polymarket put its exchange into cancel-only mode by 2:05 p.m. ET and paused relayer actions, according to its status page.
• Arkham linked the suspected attacker to wallet 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18. The wallet held about $2.65 million in POL after swaps out of USDC.e.
• Betting Intelligence and Polysights told CNBC that at least $2.7 million was withdrawn across 710 wallets.
• Reuters reported that Polymarket referred the case to UK law enforcement, and that a source named DebugBear as the compromised provider.
• Prediction News reported that only the offshore platform was hit, not Polymarket’s separate CFTC-regulated US entity.

Polymarket exploit timeline: earlier incidents and Thursday’s events

1. May 2026: A private key compromise drains about $700,000 from an internal Polymarket top-up wallet.
2. June 25, 2026: Polymarket says a compromised third-party vendor injected a malicious script into its frontend. Decrypt reported that attack took about $3 million from fewer than 15 accounts.
3. October 29, around 2:00 p.m. ET: DebugBear posts on X that it has an “ongoing security incident.”
4. October 29, by 2:05 p.m. ET: Polymarket’s exchange is in cancel-only mode and relayer actions are paused.
5. October 29, 2:33 p.m. ET: Polymarket says it has fixed an issue on its international platform, Polymarket.com, and that one of its third-party providers was compromised.
6. October 29, about 3:00 p.m. ET: Trading reopens and Polymarket says it will fully reimburse affected traders.

Background: a compromised third-party script

Reports point to a script from an outside provider that loaded on Polymarket’s website. According to 0xngmi, the developer behind DeFiLlama, the attacker compromised a web performance tracking company whose scripts loaded on Polymarket, so everyone who visited the site was exposed. Bitcoin.com News cited the same developer as tracking roughly $2.7 million in losses.

Hudson Rock described the mechanics in more detail, according to RG.org. It said a script loaded from DebugBear searched for logged-in sessions and tried to sell users’ positions and move their assets. The script also listed the same attacker wallet as a fallback recipient. In a setup like this, a site’s own code can be clean while a trusted outside script does the damage. We looked at the vendor angle in our earlier report on a Polymarket vendor breach.

On-chain, The Block said Arkham data showed several USDC.e-to-POL swaps routed through Relay before the funds were moved to other addresses. Much like cross-site scripting (XSS) vulnerabilities, a malicious script running in the browser can act with whatever session the user already has open.

Reactions from Polymarket, DebugBear and traders

Polymarket’s message was short. In a post on X it said: “Anyone who has been impacted will be made whole.” It hasn’t published its own loss figure or the number of affected users. NBC News reported that a company representative declined to comment on the $2.65 million figure or on exactly how the attack worked.

Reuters, as carried by AOL, reported that Polymarket referred the incident to UK law enforcement. A source familiar with the matter named DebugBear as the compromised provider. Separately, Betting Intelligence and Polysights told CNBC that at least $2.7 million was withdrawn across 710 wallets.

Individual losses weren’t evenly spread. One prominent trader said they lost $800,000, Prediction News reported. The outlet noted that the Polymarket exploit hit the offshore platform, not the separate CFTC-regulated US entity.

Market context

The broader market was red on Thursday, though there’s no evidence tying the move to the Polymarket exploit. CoinGecko data showed the following as of 21:58 UTC on October 29, 2026:

The Crypto Fear & Greed Index stood at 51, or “Neutral,” on October 29, 2026.

What to watch next

The first test is the payout. Polymarket has promised full reimbursement, but the reports so far don’t describe a timeline or explain how losses will be verified. They also don’t say whether sold positions will be restored or paid out in cash. Until those details are public, affected users are relying on a pledge rather than a finished process.

The second is a root-cause report. This is at least the second reported vendor script incident at Polymarket this year, after June 25, and it follows a private key compromise in May. That pattern matters as much as the dollar figure. Questions are likely about how many outside scripts load on Polymarket’s frontend and who can change them. Readers interested in custody design can compare approaches in our explainer on MPC wallet technology.

The UK law enforcement referral is also worth tracking, along with any freezes or recoveries from the attacker’s addresses. The risks for anyone using web-based trading platforms are real: frontend compromises, exchange outages and the chance that funds aren’t recovered. Rules on reporting losses for tax purposes differ by country, so a qualified professional is the right person to ask.

FAQ

What caused the Polymarket exploit?

Polymarket says a third-party provider was compromised. A source cited by Reuters named DebugBear as that provider. Hudson Rock said a script loaded from DebugBear searched for logged-in sessions and tried to sell positions and move assets.

Will Polymarket reimburse traders?

Polymarket says affected users will be made whole. Reports so far haven’t detailed a timeline or method.

Was Polymarket US affected?

No. Prediction News reported that only the offshore platform was hit, not the CFTC-regulated US entity.

Sources

• Polymarket resumes trading after $2.65 million exploit, says third-party provider was compromised (The Block)
• Polymarket Resumes Trading, Vows to Reimburse Traders After Third-Party Provider Compromise – Unchained (unchainedcrypto.com)
• Polymarket Halts Trading Over Exploit That Stole Estimated $2.7M From Users (news.bitcoin.com)
• Polymarket Pauses Trading as Prediction Market Investigates Security Incident (tech.yahoo.com)
• Polymarket resumes trading after third-party security breach, to reimburse users – AOL (www.aol.com)
• Polymarket pauses trading amid reports of users' wallets drained (www.nbcnews.com)
• Polymarket Pauses Trading After Third-Party Provider Breach (rg.org)
• Polymarket halts trading after third-party breach causes $2.65 million in losses, Prediction News (predictionnews.com)

This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrencies are highly volatile; always do your own research before investing.