Polymarket froze trading on its international exchange on Thursday, October 29, 2026. The halt followed user reports of emptied accounts. One trader said attackers drained $800,000 from their account, and another reported a $600,000 loss. Roughly 20 minutes later, Polymarket moved the exchange into cancel-only mode. Users could cancel open orders, but the platform rejected new trades. Polymarket also paused its relayer, the service that submits transactions for users. The company said it acted “out of an abundance of caution” while it investigated. Notably, the U.S. platform did not appear to suffer any impact, according to NBC News.
BREAKING: Polymarket frontend may be hacked. Trading has been restricted to cancel-only mode and relayer actions paused. There are reports of user wallets being drained and a frontend compromise. https://t.co/av2SugbE8F
— world (@world_xyz) October 29, 2026
How a Monitoring Script Became a Drain
Attackers did not break Polymarket’s smart contracts. Instead, they compromised a third-party provider, which Polymarket never named. BleepingComputer traced the malicious code to infrastructure belonging to DebugBear, a U.K. website performance firm. DebugBear sells a Real User Monitoring product that runs a small script inside every visitor’s browser. Polymarket.com loaded that script, so the attacker’s code ran with the full trust of the site itself. The script first checked whether a visitor had an active Polymarket login. If so, it borrowed that live session to move funds. It read balances and positions to estimate each account’s value. Depending on how the user signed in, it then tried to sell positions automatically or send prediction-market tokens to an attacker wallet. Additionally, it tried to convert holdings into assets the attacker could transfer. Meanwhile, the script reported results back to a DebugBear domain, which raises questions about how deep the attackers’ access went.
A Fast Timeline and a Quick Fix
The onchain trail shows how quickly the theft unfolded. According to BleepingComputer, the attacker wallet made numerous transactions with Polymarket’s prediction-market token contract between 1:50 and 1:56 PM ET. At 1:59 PM, a Polymarket production build appeared with the commit message “remove debugbear rum script.” As a result, the company had already cut the vendor out of its site before it announced anything. The exchange entered cancel-only mode at 2:05 PM. By 2:37 PM, Polymarket said it had fixed the issue. Trading then resumed after about an hour, and the incident closed around 3:05 PM. DebugBear also responded on X. It confirmed an “ongoing security incident” and told customers to remove its embed code from their websites.
How Much Was Lost and Who Pays
Reported losses vary, and Polymarket has published no official total. Blockchain analysis put the figure between roughly $2.2 million and $2.7 million. Arkham reportedly linked about $2.65 million to the suspected attacker. BleepingComputer found the attacker wallet sent about 28.6 million POL, worth roughly $2.57 million, to three further wallets. Meanwhile, analytics firms cited by CNBC counted at least $2.7 million across about 710 wallets. Bubblemaps separately estimated around 700 affected users. Polymarket pledged to reimburse every affected trader and said it referred the matter to law enforcement. CNBC reported that users with losses under $10,000 would receive funds by October 30. Users with larger losses would need to sign a release form first.
A Second Incident in 2026, and a Different Lesson
This marks the second security event at Polymarket this year, although the two incidents differ sharply. In May, attackers drained several hundred thousand dollars after compromising a roughly six-year-old private key used for internal top-up operations. Polymarket said that breach did not involve a smart contract flaw and did not touch user funds. The October attack instead targeted users directly through the browser. In other words, hardened contracts and careful key management did not protect traders from a script that the site itself invited in. Prediction markets and other onchain apps often load analytics, monitoring, and support tools on the same pages where users sign transactions. Each of those vendors therefore becomes part of the platform’s attack surface. Polymarket’s quick removal of the script limited the damage, but the case shows why teams should review which third-party code runs next to wallet sessions.
*Disclaimer: News content provided by Genfinity is intended solely for informational purposes. While we strive to deliver accurate and up-to-date information, we do not offer financial or legal advice of any kind. Readers are encouraged to conduct their own research and consult with qualified professionals before making any financial or legal decisions. Genfinity disclaims any responsibility for actions taken based on the information presented in our articles. Our commitment is to share knowledge, foster discussion, and contribute to a better understanding of the topics covered in our articles. We advise our readers to exercise caution and diligence when seeking information or making decisions based on the content we provide.
