Key points
- Polymarket says its international platform, Polymarket.com, was compromised through a third-party provider it has not publicly named.
- Data firms estimate about $2.7 million was taken from roughly 700 or more accounts; Polymarket has not confirmed a total.
- Trading resumed Thursday afternoon, but no source reviewed says withdrawals, which TechCrunch reported were paused, have restarted.
- Security researchers link the attack to a script from UK web-monitoring firm DebugBear, which has acknowledged a security incident; Polymarket has not confirmed the link.
- Polymarket said anyone affected "will be made whole."
Polymarket, one of the largest prediction markets, where people bet on the outcomes of real-world events, halted trading on its international platform on Thursday, October 29, 2026, after users reported money leaving their accounts without permission. The company said the problem came through an outside provider and promised to repay everyone affected. Trading has since resumed, but according to TechCrunch, Polymarket also paused withdrawals, and no source reviewed for this article says withdrawals have restarted.
The incident matters because it appears to be a so-called supply-chain attack: rather than breaking into Polymarket directly, attackers reportedly tampered with code from a third-party company that Polymarket's website loaded for every visitor.
What Polymarket has said
In a statement quoted by GBHackers, Polymarket said it had "identified & fixed an issue impacting our international platform, Polymarket.com," and that trading was halted "out of an abundance of caution." GBHackers noted that the statement did not name the provider or explain how attackers reached user funds.
