Third-party script breach halts Polymarket trading

• Polymarket suspended trading on Polymarket.com for about an hour on October 29
• A compromised website monitoring vendor gave attackers a route to user wallets
• It is Polymarket’s third security incident since May, with full reimbursement pledged

Polymarket suspended trading on its international exchange for around an hour on Thursday, October 29, after a compromised third-party vendor allowed attackers to drain funds from user wallets.

The company has referred the incident to UK law enforcement and committed to reimbursing all affected traders.

Cancel-only by 2 p.m.

Users began reporting unauthorized withdrawals from their accounts on Thursday afternoon, and the issue was quickly picked up across Polymarket’s official Discord.

Shortly after 2 p.m. ET, the exchange moved into cancel-only mode and paused relayer activity. Open orders could be withdrawn, but no new positions could be opened.

Polymarket confirmed on X that one of its vendors had been compromised. The company said:

“Out of an abundance of caution, we have temporarily halted trading & are working to bring the platform back online.”

Trading resumed at around 3 p.m. ET. Polymarket’s status page marked the incident resolved at 3:05 p.m., with all components, including the trading API, back to operational.

A monitoring tool turned

Polymarket has not named the vendor publicly. CNBC reported, citing a person familiar with the matter, that the provider was DebugBear, a UK-based website performance monitoring company.

DebugBear disclosed a security incident on X at around 2 p.m. It said the breach affected its Real User Monitoring service, which collects performance data from inside visitors’ browsers.

The vendor told clients to remove its code from their sites pending investigation. Polymarket’s production code shows the DebugBear script had already been stripped out by the time the exchange entered cancel-only mode.

Polymarket said the attack appeared to originate in the United Kingdom and referred it to British authorities.

The company has not confirmed total losses or the number of accounts affected. CNBC reported that analytics firms Betting Intelligence and Polysights traced at least $2.7 million in withdrawals across roughly 710 wallets.

After trading resumed, Polymarket said:

“We’ll make this right and are fully reimbursing all affected traders.”

According to CNBC, users with losses below $10,000 were due to be repaid by October 30. No timetable has been given for larger claims.

Three incidents, one pattern

This is the third security incident at Polymarket in roughly five months.

In May, more than $520,000 left an internal operations wallet. Polymarket attributed the loss to a compromised private key and said user funds and market resolution were unaffected.

On June 25, a tampered vendor script was served to users through Polymarket’s front end. Blockchain security firm PeckShield estimated losses at around $3 million across more than 11 wallets. Polymarket reimbursed affected users then as well.

The June and October incidents share the same entry point. Neither involved Polymarket’s smart contracts or its matching engine. In both cases, the exposure came from third-party code running in the customer-facing website.

That distinction carries weight well beyond prediction markets. Performance monitoring, analytics and tag management scripts are standard across operator and supplier front ends, and each one runs with the same browser-level trust as the site that loads it.

The breach also caps a difficult week for the company. Days earlier, Polymarket reportedly fired its CMO following an internal review of staged trades and undisclosed influencer payments.

Two stacks, one brand

Polymarket’s disclosures covered only Polymarket.com. Its domestic exchange, Polymarket US, continued operating throughout.

The US venue, which opened to all users in May, is run by QCX LLC, a CFTC-designated contract market. It requires identity verification and operates within a regulated clearing framework.

The international product works differently. Polymarket describes it as non-custodial, with users holding their own private keys, and it is closed to US residents.

Separate infrastructure kept the incident away from US customers. The reputational exposure is harder to contain, however, given that both products trade under the same name.

Pressure from all sides

The incident hits during peak trading for political contracts. Polymarket’s midterm markets are among its most active ahead of the November 3 US elections.

Institutional backing raises the stakes further. Intercontinental Exchange, owner of the New York Stock Exchange, completed a $600 million investment in Polymarket in March, on top of a $1 billion commitment made in October 2025.

The competitive field is also tighter than a year ago. Kalshi led a record $11 billion weekend across the sector earlier this month, and DraftKings says its DKeX exchange already ranks third in the US.

Polymarket’s next step is a full post-mortem. Two front-end compromises in four months put its vendor vetting and script controls under direct scrutiny, and counterparties will want detail on what has changed. Reimbursement alone will not answer those questions.