Polymarket resumed trading at 3 p.m. ET Thursday after a third-party script drained roughly $2.7 million from hundreds of user wallets, days before the midterms.
Trading came back online after nearly an hour offline. At around 2 p.m. ET, Polymarket had moved into cancel-only mode, restarting at 3 p.m. ET.
How the attack ran through a vendor
Polymarket.com ran code from DebugBear, a UK-based vendor that helps websites track performance. An attacker replaced it with a script designed to target users, Polymarket said.
Using their active sessions, the malicious script sold trading positions and transferred funds from the wallets of users who had the site open during a brief period.
Polymarket deleted the exposed code, flushed its caches, halted trading and relayer functions, then restarted active login sessions. Its separate US platform wasn't affected.
Out of an abundance of caution, we have temporarily halted trading & are working to bring the platform back online
The company traced the apparent origin of the attack to the United Kingdom and referred the matter to British authorities, after referring it to law enforcement, Polymarket said.
There was no reported breach of Polymarket's smart contracts. Instead, attackers abused a trusted third-party script running on the site, a route that's become a common way for malicious actors to reach large platforms.
DebugBear acknowledged an "ongoing security incident" and told customers with its real-user monitoring (RUM) product to delete the code embedded in their sites. The vendor posted on X that it was handling the incident at around 2 p.m. ET Thursday.
Two estimates of what was taken
Betting Intelligence and Polysights, blockchain analytics firms, estimated that 710 wallets lost about $2.7 million. The Block, a crypto news website, cited data from blockchain analysis group Arkham, reporting that users' wallets had lost some $2.65 million in cryptocurrencies.
Two third-party estimates of the loss
Betting Intelligence and Polysights
Blockchain analytics firms
about $2.7M
- Taken from 710 wallets
- Estimate by two analytics firms
Arkham data
Cited by The Block
some $2.65M
- Reported as cryptocurrencies siphoned from user wallets
- Blockchain analysis group data
A Polymarket representative declined to comment on the $2.65 million figure or the precise nature of the attack. The company pledged to reimburse affected traders, saying on X that anyone impacted would be made whole.
One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement
The $3.9 million refund
Polymarket pledged to reimburse affected traders, setting the total at $3.9 million. The amount included $2.7 million for stolen funds and $1.2 million to address losses tied to the trading pause.
In total, we’re returning $3.9M to traders: the $2.7M plus $1.2M to cover pause-related losses. No claims or tickets needed: we identified eligible wallets from on-chain and trading data.
Refunds were scheduled by October 30 for users who lost less than $10,000. Those with greater losses were asked to complete a release form.
By Friday afternoon, Polymarket said 95% of affected wallets had been refunded.
| Item | Amount |
|---|---|
| Stolen funds | $2.7M |
| Pause-related losses | $1.2M |
| Total refunds | $3.9M |
| Refund threshold needing a release form | losses above $10,000 |
| Wallets refunded by Friday afternoon | 95% |
Polymarket said it would fully reimburse all affected traders. “We’ll make this right and are fully reimbursing all affected traders,” it said, adding that “anyone who has been impacted will be made whole”.
Why the usual defences missed it
The harmful script sent data to a server hosted on DebugBear's domain, said Gareth Bowker, Head of Information Security at Jscrambler. A content security policy allowing a vendor domain marked as trusted wouldn't have blocked that communication.
Frequent vendor updates make subresource integrity checks less practical for real-user monitoring scripts, Bowker said. Static controls alone can't provide enough protection; organizations must also watch third-party code as it runs in the browser.
Polymarket’s prompt decision to halt trading, and its commitment to reimburse affected traders in full, should limit the losses for users. Users should still review their transaction history and revoke any token approvals they do not recognize. A user cannot reasonably detect a malicious script on a trusted site. Control over what runs on that site is the platform’s responsibility.
A user can't reasonably spot a malicious script on a site they trust, Bowker said. Control over what runs there rests with the platform.
A second vendor compromise this year
Polymarket faced a second reported third-party website compromise this year. In April, the company disputed a hacker's claim that more than 300,000 user records had been stolen, saying the data could already be accessed publicly through its APIs and blockchain data. In June, a vendor-injected malicious script enabled attackers to take about $3 million from users.
In September, Polymarket was valued at $21 billion after Donald Trump Jr. and a group of investors put in $1 billion. The platform handles about $200 million worth of trading activity daily.
- $200MDaily trading activity
- $21BValuation in September
- about $2.7MTaken, per analytics firms
Polymarket and rival Kalshi are at the center of an intense, multimillion-dollar dispute between US states and the Trump administration over which authorities can regulate betting on prediction markets hosted by the sites.
Bets under scrutiny
Bloomberg News reported earlier on Thursday that Polymarket was investigating claims of questionable wagers during Israel's closely watched elections. Shana Bautista, who leads global intelligence and investigations at the company, said it was also looking into “dozens” of bets related to the US midterms.
- 29 October, about 2 p.m. ETTrading halted
Polymarket moves into cancel-only mode; DebugBear says on X it is handling an ongoing security incident.
- 29 October, 3 p.m. ETTrading resumes
Polymarket brings the platform back online after nearly an hour.
- 30 OctoberRefunds due
Users with losses below $10,000 are due to be paid.
- Friday afternoon95% refunded
Polymarket says 95% of affected wallets have been paid.
- 3 NovemberUS midterms
Prediction markets expected higher volumes for the vote.
What we know
- Polymarket resumed trading at 3 p.m. ET on Thursday, October 29, 2026.
- Polymarket said it was returning $3.9 million in total.
- Polymarket's separate US platform was not affected.
Still unclear
- The precise nature of the attack, on which a Polymarket representative declined to comment.
- Whether users actually lost money, which Polymarket did not confirm.
- The final toll, since the $2.7 million and $2.65 million figures come from third-party analytics rather than Polymarket.
Trading is back, but the refunds aren't finished. Users with larger losses still have to complete a release form. The November 3 US midterms will be the first high-volume test since the platform reopened.
