Polymarket halts trading after $2.65 million exploit via compromised third-party script, pledges full refunds
A wallet-draining script served through website-monitoring provider DebugBear hit Polymarket.com on Oct. 29, 2026. Trading resumed within about an hour; the company says all affected traders will be reimbursed.
TL;DR
- Polymarket put its exchange into cancel-only mode and paused relayer actions on Oct. 29, 2026 after a compromised third-party provider exposed users of its international site, Polymarket.com.
- The Block put the exploit at a suspected $2.65 million; BleepingComputer traced about 28.6 million POL (roughly $2.57 million) moved out of a suspected attacker wallet.
- A source told Reuters the provider was DebugBear, a website performance-monitoring service; DebugBear told customers to remove its RUM embed code.
- Trading resumed about an hour later; Polymarket referred the case to UK law enforcement and says it will fully reimburse affected traders.
On the same day Binance was dealing with a multibillion-dollar breach, prediction market Polymarket had its own security scare. Polymarket placed its exchange in cancel-only mode and paused relayer actions on Oct. 29, 2026 after one of its third-party providers was compromised, The Block and BleepingComputer reported.
"One of our third party providers was compromised, and we have referred this to relevant law enforcement," Polymarket said, per BleepingComputer. "Anyone who has been impacted will be made whole." Reuters reported the case was referred to UK law enforcement.
A monitoring script turned wallet drainer
A source familiar with the matter identified the provider as DebugBear, a website performance-monitoring platform, Reuters reported. DebugBear said on X it was affected by "an ongoing security incident" and urged customers using its RUM product to remove the embed code from their websites.
BleepingComputer, citing researchers at Hudson Rock and its own analysis of the file, said the malicious JavaScript was served from DebugBear infrastructure and was designed to hijack logged-in Polymarket sessions: it checked balances and positions, tried to sell users' prediction-market positions or transfer their tokens, and moved assets to an attacker-controlled wallet.
How much was taken
The Block described a suspected $2.65 million exploit. BleepingComputer found that the suspected attacker wallet transferred about 28.6 million POL, worth roughly $2.57 million, to three other wallets, and that Hudson Rock saw about $2.19 million still in the wallet during its investigation. Polymarket has not disclosed how many users were affected or how much was stolen, per BleepingComputer.
About an hour of downtime
According to BleepingComputer, the cancel-only mode began at 2:05 p.m. ET, the company said the issue was fixed at 2:37 p.m., and the incident was marked resolved at 3:05 p.m. ET. "We'll make this right and are fully reimbursing all affected traders," Polymarket said on X.
What it means for Web3 teams – Analysis
No smart contract failed here. A harmless-looking analytics tag did. Every third-party script on a dApp front end runs with the same access to a signed-in session as the app itself. Teams should inventory front-end scripts, pin them with subresource integrity or self-host them, apply a strict content security policy and treat monitoring vendors as part of the attack surface. This is not investment advice.
FAQ
What happened at Polymarket on Oct. 29, 2026?
A compromised third-party provider served malicious JavaScript on Polymarket.com. Polymarket switched to cancel-only mode, paused relayer actions, fixed the issue and resumed trading about an hour later.
How much was lost?
The Block reported a suspected $2.65 million exploit; BleepingComputer traced about 28.6 million POL (roughly $2.57 million) out of a suspected attacker wallet. Polymarket has not disclosed a figure.
Which provider was compromised?
A source told Reuters it was DebugBear, a website performance-monitoring service, which confirmed an ongoing security incident.
Will users be reimbursed?
Polymarket says it is fully reimbursing all affected traders.
Sources
News summary based on the sources above. Not investment, legal or tax advice. Editorial policy & corrections · Report an error
Building in Web3? Turn the news into trust.
Positioning, KOL programs, LinkedIn systems and claim-safe content for Web3 and fintech teams.
Related
Binance hit by $6.3 billion hack, the largest on record; about $3 billion frozen
Binance says a compromised DevOps engineer's laptop may have let an attacker submit unauthorized withdrawals. TRM Labs and Chainalysis link the theft to North Korea's TraderTraitor; Binance pledges to cover all losses.
NYSE owner ICE teams with Trade[XYZ] to bring Hyperliquid-based perpetual futures to the U.S.
Intercontinental Exchange announced on Oct. 29, 2026 a definitive agreement to run a regulated U.S. market for Trade[XYZ]'s perpetual contracts, subject to regulatory approvals. ICE is also investing in the company.
FCA settles HTX case: exchange exits UK and pledges no unlawful crypto promotions until 2031
The UK regulator said on Oct. 29, 2026 that Huobi Global gave High Court undertakings covering HTX's website, apps and social media. UK users can no longer deposit or sign up.