Polymarket Halts International Trading for One Hour After Vendor Breach; Bubblemaps Estimates $2.7 Million Taken From About 700 Users

Since a June 2026 breach that cost Polymarket traders more than $2 million, the platform has now had a second security failure in five months. This one hit today, Oct. 29, and it came through a vendor, not Polymarket's own site.

What happened Thursday

Polymarket's status page opened an incident at 2:05 p.m. ET. The international exchange, Polymarket.com, went into cancel-only mode and relayer actions were paused.

At 2:37 p.m., the company said it had identified and fixed the problem, and that one of its third-party providers had been compromised. It said it had referred the matter to law enforcement. AP reported that the agency is in the United Kingdom.

Trading resumed around 3 p.m. and the incident was marked resolved at 3:05 p.m. The status page logged a one-hour major outage for Predictions and the Predictions Trading API.

The company's final post on X read: "We'll make this right and are fully reimbursing all affected traders." Polymarket said it halted trading "out of an abundance of caution."

Polymarket US, the federally regulated platform for American users, was not affected. The hacked platform is the crypto-based international exchange, which is banned in the United States and several other countries.

How many were hit, and for how much

Polymarket has not said how much was taken or how many accounts were affected. It declined to answer Wired's questions on both.

Bubblemaps, the blockchain analytics firm, estimates about 700 users were affected and roughly $2.7 million was stolen. That is an outside estimate, not a company figure. Prominent traders also posted on X that they had lost money.

The Washington Post reported that users in Polymarket's official Discord began raising alarms around 1:30 p.m. ET, about 35 minutes before the halt.

The DebugBear link

Polymarket has not named the compromised vendor. Reports have tied the incident to DebugBear, a UK company that sells website performance-monitoring tools.

DebugBear posted on X that it was "impacted by an ongoing security incident" and told customers using one of its products to remove the embed code from their sites. Its own website was down Thursday afternoon. The company did not immediately respond to a request for comment.

Three security researchers have published teardowns of the file served from DebugBear's content network: Hudson Rock, Dancho Danchev and DeFiprime. They describe it as a wallet drainer. By their account, it looked for signed-in traders, tried to sell their positions and sent the proceeds to an attacker's wallet.

None of the three reports ran the code against a live account, so what they describe is what the code was written to do. On-chain totals are the better measure of actual losses.

The analysts found no code that stole passwords, seed phrases or private keys. DeFiprime noted that the script used the trader's existing API credentials in place. A script running inside a logged-in page has the same authority as the page's own code, so every order and transfer was signed by the site's own signer and sent to Polymarket's own trading API or relayer.

That design also made the traffic look routine. Settings and reports went to DebugBear's data host under paths typical of performance monitoring.

Hudson Rock and Danchev also found bugs in the code. It counts "submitted" and "pending" relayer states as success, and one balance check compares a value with itself. The attacker's own reports may therefore overstate the haul.

Polymarket's position

The company's case is simple. The breach was in a vendor, not its website. It identified and fixed the problem within about 30 minutes, paused trading, notified law enforcement and pledged to make every affected trader whole.

The record so far supports the speed of the response. Whether the refunds are paid in full is a separate matter. The company has made a pledge, not announced a completed payout.

The wider context

Polymarket has drawn scrutiny on other fronts. In April, the Justice Department charged Army Special Forces soldier Gannon Ken Van Dyke with using classified information about the Jan. 3 raid that captured Venezuela's Nicolás Maduro to bet on the platform. Prosecutors allege he made $409,881. He has pleaded not guilty.

A Google employee has also been accused of using confidential information to make millions. That person has also pleaded not guilty.

On Oct. 20, Defense Secretary Pete Hegseth sent a memo barring Pentagon personnel from financial transactions, including on Polymarket and Kalshi, that use nonpublic information. The memo says such activity creates "a signal" that hostile intelligence services could exploit. Nothing in the reporting links the memo to Thursday's breach.

Polymarket raised $1 billion in August in a round led by 1789 Capital, where Donald Trump Jr. is a partner. The round valued the company at $21 billion.

What is still open

Polymarket has not disclosed the final loss total, the number of accounts, the timeline for refunds or the name of the vendor. DebugBear has not publicly explained how its content network came to serve the malicious file.

No arrests or charges have been announced. The referral to UK law enforcement is the only formal step on record.