Polymarket Hack Drains Hundreds of Accounts Through Compromised Vendor

A Polymarket hack on October 29, 2026 drained hundreds of user accounts. Blockchain-based estimates put the losses at between about $2.2 million and $2.7 million. The prediction market blamed a compromised third-party provider and briefly halted trading on Polymarket.com. It says every affected user will be made whole.

What we know about the Polymarket hack

Blockchain analyst Conor Grogan posted on X that 995 accounts had been drained for a total of $2,654,211.42, as U.Today reported. The two largest single losses he flagged were $341,000 and $307,000.

How the Polymarket hack unfolded

An on-chain timeline shared by blockchain investigator StarPlatinum suggests the attacker collected the bulk of the funds in about an hour. However, crypto.news noted that this timeline comes from an X account and hasn’t been independently confirmed.

The wallet figures (in UTC) come from the unconfirmed social media timeline. The status page details and the reopening (in ET) come from Unchained’s account of the outage. Polymarket’s own statement said trading was halted “out of an abundance of caution” and that “anyone who has been impacted will be made whole.”

A compromised monitoring script

Polymarket’s statement did not name the vendor. A source told Reuters it was DebugBear, a website performance monitoring platform, according to the Reuters report carried by AOL. DebugBear said on X it was affected by an ongoing security incident and urged customers to remove its RUM code from their websites. Reuters also reported that Polymarket referred the case to UK law enforcement.

Researchers at Hudson Rock went further. Their analysis found Polymarket-specific wallet-draining code inside a third-party script. They also found a production build note reading “remove debugbear rum script”, timestamped 17:59:20 UTC.

Where the money went

Grogan said the attacker converted all the stolen funds into Polygon’s POL token, most likely to avoid having them frozen. In total, the attacker collected about 28.6 million POL. One trader claimed on X to have lost $800,000 and said a friend lost $600,000. Those claims are unverified.

What is still unclear

The size of the damage is the biggest open question. Polymarket hasn’t published a loss figure. Bubblemaps put it at roughly $2.7 million across about 700 users, GlobeTV reported. That is a lower account count than Grogan’s 995. Hudson Rock says total losses haven’t been verified.

It’s also unknown how and when reimbursements will be paid. Nor is it clear whether any of the converted POL can be traced or recovered, or how the vendor’s systems were breached in the first place.

How markets reacted, and the earlier breaches

Major cryptocurrencies were lower over the past 24 hours, but nothing in the available data links those moves to the Polymarket hack. The figures below are from CoinGecko as of 21:13 UTC on October 29, 2026.

The Crypto Fear & Greed Index read 51, or Neutral, on October 29.

The incident follows two earlier breaches this year. In June 2026, users lost about $3 million in a similar supply-chain attack, Halborn explained. In that case, a compromised vendor was used to inject malicious JavaScript into the site. PUSD was taken from at least 11 wallets, then bridged to Ethereum and swapped into about 1,893 ETH.

In May, roughly $700,000 was stolen after hackers compromised a six-year-old private key used for internal operations, Rolling Out recalled. Polymarket said then that customer funds and smart contracts weren’t affected. It rotated the key and announced plans to move to a more secure key management system.

What it means for investors

The main lesson from this Polymarket supply-chain attack is that users can be exposed through code a platform loads from outside companies, not only through the platform’s own systems. Traders can’t easily inspect that code themselves.

A few points are worth keeping in mind:

• The reimbursement pledge is a company statement. Details on timing and method haven’t been released.
• Incidents like this tend to attract fake “refund” offers. No legitimate support team will ask for a seed phrase or private key.
• Prediction markets carry their own risks, including the total loss of a position, platform outages and a legal status that differs by country.

Anyone affected may also face tax or legal questions around stolen funds and later compensation. Rules vary widely between jurisdictions, so checking with a qualified professional is the safer route.

Bottom line

Polymarket reopened trading within about an hour of its status page showing cancel-only mode. Even so, this is the second breach this year tied to a compromised vendor, which may put its handling of outside code under closer scrutiny. The next things to watch are an official loss figure, the reimbursement process and whether investigators can follow the 28.6 million POL.

Sources

• Polymarket Hit by Massive Hack (U.Today)
• Polymarket Resumes Trading, Vows to Reimburse Traders After Third-Party Provider Compromise – Unchained (unchainedcrypto.com)
• Polymarket Restores Trading After Major Security-Related Outage (www.cryptotimes.io)
• Polymarket resumes trading after breach at UK vendor drains about $2.7 million (globetv.app)
• Polymarket resumes trading after third-party security breach, to reimburse users – AOL (www.aol.com)
• Polymarket Breach Alert: Wallet-Draining Code Found in a Third-Party Script (www.infostealers.com)
• Polymarket restricts trading as users report drained wallets (crypto.news)
• Explained: The Polymarket Hack (June 2026) (www.halborn.com)
• Polymarket halts trading after $2.7 million exploit hits users (rollingout.com)

This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrencies are highly volatile; always do your own research before investing.