Polymarket restricted trading on its international platform for an hour on October 29, 2026, after saying a third-party provider had been compromised. Researchers linked the incident to a website monitoring script. The number of affected accounts, final losses and terms of the promised reimbursements remain unclear.
- Trading restriction: 18:05 to 19:05 UTC.
- Losses: The Wall Street Journal reported at least $2.6 million in user funds drained. Polymarket has not confirmed a final total.
- Suspected route: Reporting linked the incident to code loaded into Polymarket’s trading website.
- Reimbursement: Polymarket promised to make affected users whole but has not explained how or when.
What happened on October 29?
Polymarket’s status timeline shows that its international platform entered cancel-only mode at 18:05 UTC. Users could cancel existing orders, but new orders and trades stopped processing. The company also paused relayer actions, services used to submit signed wallet actions to the blockchain.
At 18:37 UTC, Polymarket said it had identified and fixed the issue. At 18:55 UTC, it said trading would resume at about 3 p.m. Eastern, or 19:00 UTC. The status page marked the incident resolved at 19:05 UTC. The restriction lasted about an hour. That does not tell us how long the investigation or reimbursements may take.
Polymarket said a third-party provider had been compromised and referred the incident to law enforcement. Its public notice did not name the provider. Reuters reporting linked it to DebugBear, a website performance-monitoring company, while security reporting connected the incident to a JavaScript monitoring script.
That identification comes from outside reporting, not Polymarket’s status notice. The company has not published a full technical postmortem explaining how the provider was compromised or what the script managed to do in individual accounts.
How could a website script put trades at risk?
Websites often load software from outside vendors to measure performance or provide other services. JavaScript that runs inside a trading page may be able to interact with parts of the page and its active application. A monitoring script is not automatically isolated from the rest of the site just because its job is to measure page speed.
Security reporting described suspicious code that reportedly searched the running Polymarket application for trading components. It may have tried to use access available in active sessions to sell positions or move assets. Researchers outlined two possible paths: transferring position tokens, or selling positions and then transferring the proceeds. Public evidence does not show which attempts succeeded in each account.
A signed order authorizes a particular trade. A token transfer is a separate movement of assets between wallets. Polymarket’s trading documentation describes orders being validated and matched before trades settle on-chain. Order records and blockchain transfers can therefore show different parts of an incident. Neither record alone establishes what a user intended, and the two types of activity may raise different reimbursement questions.
The available evidence does not establish that users’ seed phrases or private keys were stolen, or that Polymarket’s smart contracts were exploited. A compromised website integration can expose an active application session to misuse without proving either of those things.
What do the reported losses mean?
The Wall Street Journal reported at least $2.6 million in user funds drained. Other outside estimates put losses at about $2.7 million. These are reported estimates, not a final accounting from Polymarket, and they should not be added together. They may reflect overlapping observations, different measurement methods or different reporting times.
Available reporting also does not make clear whether the estimates cover only assets transferred out, include proceeds from unauthorized position sales, or combine both. A suspected wallet balance does not automatically equal users’ total losses. Funds may have moved onward, asset prices may have changed, and wallet activity still needs to be matched to affected accounts.
Traders have also reported individual losses. One trader using the name Car said about $800, 000 had disappeared from his account and that all his positions were sold. Polymarket has not confirmed the account or its reported losses. The company has not published how many accounts were affected, which actions succeeded or how much it has reimbursed.
WIRED reported an estimate of about 700 affected users attributed to blockchain analytics firm Bubblemaps. Polymarket has not confirmed that figure either.
What does “make users whole” mean?
Polymarket promised to make affected users whole, but has not defined the remedy. Replacing funds transferred from an account is different from compensating a trader whose positions were sold without consent.
Would the platform restore the contracts, compensate users based on the sale price, or use another valuation method? A position’s eventual value depends on the market’s recorded outcome, so the method could have a significant effect on what reimbursement means.
Polymarket has not published a valuation method, claims deadline, payment schedule or figures for completed reimbursements. A promise to compensate users is not the same as resolving their claims.
What traders can take away
The incident shows that a platform’s security boundary can extend beyond its smart contracts and wallet setup to code loaded into its website. That is a useful lesson, but the specific control failure remains unknown.
Browser protections such as Subresource Integrity can check whether downloaded code matches a cryptographic fingerprint specified by the site. Content Security Policy can limit which scripts a browser runs. These measures can reduce certain risks, but their effectiveness depends on how they are implemented and where code is served from. Polymarket has not disclosed whether the affected integration used these protections or why the suspicious code was accepted.
Users should verify the domain before signing, read wallet prompts carefully, and keep records of order history and wallet activity. Those habits can help, but they cannot fully protect you from malicious code running on a legitimate trading site. Security is not a job that can be outsourced to users clicking more cautiously.
The October notice concerned Polymarket’s international platform and did not identify its separate American exchange as affected. WIRED reported that the US venue was unaffected. The scope of the notice alone, though, does not prove that finding.
Polymarket also disclosed a separate third-party incident in June 2026. CoinDesk reported losses of approximately $3 million in that incident. Available information does not establish that the June and October incidents involved the same supplier, attacker or technical weakness. Polymarket faces fresh $3.46 million security crisis.
Key questions and answers
-
How long was trading restricted?
Polymarket’s status timeline records a restriction from 18:05 to 19:05 UTC on October 29, 2026. Trading was expected to resume at about 19:00 UTC, and the incident was marked resolved five minutes later.
-
Is the final loss total known?
No. The Wall Street Journal reported at least $2.6 million in user funds drained, but Polymarket has not published a reconciled total or clarified how reported position sales factor into the estimates.
-
Did Polymarket name DebugBear?
No. Reuters and security reporting linked the incident to DebugBear. Polymarket’s public notice referred to a compromised third-party provider without naming it.
-
Were private keys stolen?
The available evidence does not establish that. Researchers described code reportedly attempting to use access available within active trading sessions, but have not publicly established which actions succeeded in each account.
-
What should affected users do?
Keep records of order history and wallet activity, review account activity, and contact Polymarket support. The company has not published a claims deadline or detailed reimbursement process.
