Vulnerabilities · Threat Intelligence
Polymarket halts trading after $2.5m crypto theft via vendor breach
Polymarket paused trading for nearly an hour after attackers used a compromised third-party script to steal around $2.5 million in cryptocurrency. The company says affected users will be reimbursed.
Ross Grant2 min read
The short version
Polymarket, a website where people trade on predictions, had to stop trading for about an hour after hackers stole around $2.5 million in cryptocurrency. The attackers got in through a tool Polymarket used to monitor its website. The company says it will pay back anyone who lost money.
By the numbers
- $2.5mestimated value of cryptocurrency stolenBleepingComputer
- 1 hourduration Polymarket trading was haltedNBC News
What happened?
Polymarket, a prediction market platform, halted trading for nearly an hour on 29 October 2026 after attackers used a compromised third-party script to steal cryptocurrency from user wallets. Blockchain analysis traced about $2.5 million in stolen assets. Polymarket says affected users will be reimbursed and has referred the incident to UK law enforcement.
Who is affected
Polymarket, a popular prediction market platform, halted trading on its international site for about an hour on 29 October 2026. The incident affected users who had active wallets on the platform during the attack window. The company has not said how many users lost funds, but blockchain analysis traced about $2.5 million in stolen cryptocurrency. Some users on Polymarket’s Discord channel reported their wallets had been drained, though Polymarket has not confirmed individual losses [NBC News (opens in a new tab)][BleepingComputer (opens in a new tab)].
How the attack worked
According to reports, attackers compromised DebugBear, a third-party web analytics and performance tool used by Polymarket. The attackers injected a malicious JavaScript script into Polymarket’s website via DebugBear’s infrastructure. This script checked if a visitor was logged in and then tried to use their session to make unauthorised trades or transfer tokens to an attacker-controlled wallet. The malware adapted its method depending on how the user authenticated, either selling prediction-market positions or transferring tokens directly. The script also communicated with DebugBear’s servers to receive instructions and send data about targeted accounts. Blockchain records show the attacker’s wallet received about 28.6 million POL tokens, worth roughly $2.5 million, shortly before Polymarket suspended trading [BleepingComputer (opens in a new tab)].
The response
Polymarket placed its exchange into cancel-only mode at 2:05 p.m. ET and paused relayer actions while investigating. By 2:37 p.m., the company said it had fixed the issue and halted trading as a precaution. Trading resumed about an hour after the initial suspension. Polymarket posted on X (formerly Twitter) that anyone affected would be “made whole” and that all affected traders would be fully reimbursed. The company also said it had referred the matter to British law enforcement, as the attack appeared to originate from the UK. DebugBear confirmed it was experiencing a security incident and advised customers to remove its monitoring code from their websites. At the time, DebugBear’s own website was offline, possibly as part of containment efforts [NBC News (opens in a new tab)][BleepingComputer (opens in a new tab)].
What you should do
For users of Polymarket or any crypto platform, this incident highlights the risk of third-party integrations. If you use similar platforms, check for official updates and consider temporarily disconnecting wallets or removing third-party scripts if you run a website. Always monitor your accounts for unauthorised transactions, especially after a reported breach.
There is no primary statement from Polymarket or DebugBear at this time. The exact number of affected users and the final amount stolen have not been confirmed by the company. The reimbursement process details are also unclear.
Claimed vs confirmed
- Unconfirmed
Polymarket users' wallets were drained during the breach.
Reported by users on Discord; Polymarket has not confirmed individual losses.
- Confirmed
About $2.5 million in cryptocurrency was stolen.
Blockchain analysis traced this amount to attacker wallets, as reported by BleepingComputer.
Why it matters
This attack shows how a weakness in a third-party tool can put user funds at risk, even if the main platform is secure. It highlights the importance of monitoring all software dependencies, especially in financial services.
Key points
- Attackers stole about $2.5 million in cryptocurrency from Polymarket users.
- The breach came through a compromised third-party analytics script.
- Polymarket halted trading for about an hour and promised to reimburse affected users.
- The attack was traced to infrastructure in the UK and reported to law enforcement.
- No details yet on exactly how many users were affected or how reimbursement will work.
Sources
CNBC
Reference
NBC News
Reference
BleepingComputer
Reference
