Prediction-market platform Polymarket resumed trading on Oct. 29, 2026, after a security incident that preliminary reports said may have drained more than $2.6 million from users of its international platform. Polymarket said it had fixed the issue and would fully reimburse affected traders.

The company temporarily halted trading and referred the breach to law enforcement. “One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement,” Polymarket said in an announcement.

How the incident unfolded

Polymarket initially placed the exchange in order-cancellation mode and suspended operations through its relayer, a component that helps execute user actions. The company later said it had identified the cause and fixed the problem affecting Polymarket.com, according to a status update.

The Wall Street Journal, citing a person familiar with the matter, reported that the incident was linked to DebugBear, a third-party website-performance monitoring service. Preliminary information suggested that malicious code may have accessed active Polymarket user sessions and used them to sell open positions.

Crypto investor Evan Luthra said the incident may have affected 995 accounts. According to Luthra, the attackers initially sold positions at about 3% below market prices, then cut the sale prices further, converted the proceeds into POL tokens and transferred them to attacker-controlled addresses.

Luthra also said one trader reported losing $800,000 and that the trader’s friend lost $600,000. Polymarket has not fully confirmed those details.

Blockchain transaction analysis pointed to a suspected attacker’s wallet whose balance reached roughly $2.65 million in POL. Onchain analytics indicated that the assets were later transferred to other addresses.

DebugBear separately reported a security incident and urged customers that had used one of its products to remove the relevant embedded code from their websites.

After restoring trading, Polymarket said: “We’ll make this right and are fully reimbursing all affected traders.”

Previous Polymarket security incidents

In May 2026, onchain analyst ZachXBT reported a likely compromise of Polymarket’s deployer address on the Polygon network. Bubblemaps said attackers were withdrawing roughly 5,000 POL every 30 seconds. A Polymarket representative said user funds and the platform’s market-settlement mechanisms were not affected.

In late June, Polymarket users lost about $3.1 million in PUSD on Polygon in a phishing attack that leveraged the EIP-7702 delegated-execution mechanism, according to AMLBot. The stolen assets were converted into USDC.e, bridged from Polygon to Ethereum, swapped for Ethereum and distributed among new wallets.

Disclaimer: This material is for informational purposes only and is not advertising gambling or a call to participate in it. Polymarket is mentioned solely as part of a digital asset market overview and is not intended to promote or market the platform.

Source: Incrypted