Polymarket hack drains estimated $2.7M from more than 700 accounts, trading halted an hour

Blockchain analytics firm Bitquery estimates that the Polymarket hack drained about $2.73 million from 737 accounts on Thursday, Oct. 29, after attackers tampered with a third-party script and liquidated traders' positions.

The attack hit Polymarket.com, the company's cryptocurrency-based international exchange. Polymarket US, which operates separately under US financial regulation, was not involved, Casino.org reported. The company said it had fixed the issue and would make affected customers whole.

How the Polymarket hack worked

Researchers at Hudson Rock identified a modified script hosted on infrastructure belonging to DebugBear, a UK-based website performance monitoring company, according to Casino.org. Analysis by BleepingComputer found the code checked logged-in users' balances and open prediction-market positions, liquidated the positions and transferred the assets to a wallet the attackers controlled.

Because the code ran inside the genuine Polymarket site, users lost funds without clicking phishing links or disclosing credentials. BleepingComputer's on-chain tracking followed about $2.57 million in Polygon's POL token from a central attacker wallet to three separate addresses.

DebugBear acknowledged an ongoing security incident and urged all customers using its Real User Monitoring product to remove the embedded snippet from their websites while third-party investigators assess the breach, Casino.org reported.

Trading stopped for an hour, then resumed

Polymarket placed the exchange in cancel-only mode at 2:05 p.m. Eastern time on Thursday, blocking new orders while allowing open bids to be canceled. Normal trading resumed by 3:05 p.m., according to the platform's status page, as cited by Casino.org.

"One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement," Polymarket said on X. The company added that anyone impacted would be made whole. GamblingNews reported that the referral went to UK law enforcement.

What Polymarket has pledged on reimbursements

Polymarket has not confirmed how many accounts were hit or how much was taken. The figures in circulation come from blockchain analysts. Bubblemaps estimated around 700 affected users on the international platform. Bitquery put the count at 737 users and the loss at $2.73 million.

On reimbursement, Casino.org, citing CNBC, reported that Polymarket told users on Discord that traders who lost less than $10,000 would have funds restored by Friday, Oct. 30. Account holders with larger losses would need to sign a formal release agreement before they are paid, Casino.org reported.

A second breach in four months

The Oct. 29 attack is the second major supply-chain security breach to hit Polymarket in four months. In June 2026, a separate third-party vendor compromise drained roughly $3 million from user wallets, Casino.org reported. Both incidents involved outside software, and Polymarket described the October problem as a compromised third-party provider.

Separately, the Michigan Gaming Control Board has ordered Polymarket to leave the state by Nov. 25, 2026, GamblingNews reported, one of the latest developments in the dispute between state regulators and prediction-market operators.