Polymarket Hack Drains Estimated $2.7M From Hundreds of Traders

Hackers siphoned roughly $2.7 million from over 700 Polymarket accounts on Thursday (Oct. 29) via a compromised third-party script, triggering a brief platform shutdown and a pledge to reimburse all victims.

Blockchain analytics firm Bubblemaps estimated that around 700 users were affected by the attack on Polymarket’s international platform. The company has not confirmed the number of victims or the amount stolen but said it had fixed the issue and would make affected customers whole.

The incident affected Polymarket.com, its cryptocurrency-based international exchange, not Polymarket US, which operates separately under US financial regulation.

Security researchers found that attackers had tampered with JavaScript code embedded in Polymarket’s website, allowing malicious instructions to run when traders visited the legitimate site. The breach involved DebugBear, a UK-based provider of website performance-monitoring software.

How Hackers Targeted Traders

Cybersecurity researchers at Hudson Rock identified a modified script hosted on DebugBear’s infrastructure that actively targeted traders’ logged-in sessions.

According to an analysis by BleepingComputer, the malicious code scanned users’ active balances and open prediction-market positions before automatically liquidating holdings and transferring assets to an attacker-controlled wallet.

Because the code ran inside the authentic Polymarket site, users lost funds without clicking phishing links or disclosing credentials.

On-chain tracking by BleepingComputer traced transactions involving approximately $2.57 million in Polygon’s POL token from a central attacker wallet across three separate addresses.

DebugBear acknowledged an ongoing security incident and urged all customers using its RUM product to immediately remove the software’s embedded snippet from their websites while third-party investigators assess the breach.

Trading Suspended & Reimbursements Issued

Polymarket placed its international exchange into cancel-only mode at 2:05 p.m. Eastern time on Thursday, halting new orders while allowing open bids to be canceled. Normal trading operations resumed by 3:05 p.m. ET, according to the platform’s official status page.

“One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement,” Polymarket stated on X, emphasizing that anyone impacted would be made whole.

According to CNBC, Polymarket informed users on Discord that traders who lost less than $10,000 would have their funds restored by Friday (Oct. 30). Account holders with larger losses will be required to sign a formal release agreement prior to receiving reimbursement.

The event marks the second major supply-chain security breach to hit Polymarket in four months. In June 2026, a separate third-party vendor compromise resulted in roughly $3 million being drained from user wallets.