In this article5 sections
Polymarket suspended trading for about an hour on October 29, 2026, after a compromised third-party script allowed attackers to sell users’ positions and move their funds without authorization, Cointribune reported. The losses were estimated at a minimum of $2.6 million across more than 700 accounts.
Traders described unauthorized sales and drained balances, including one user who said $800,000 was lost and another whose account was emptied of $600,000. Polymarket has pledged to reimburse everyone affected and said it referred the case to British authorities.
Also read: Kalshi, Polymarket Hit Record $2.7B Weekly Crypto Volume
Key facts
- The incident began on October 29 on the international Polymarket.com venue; trading was placed in “cancel-only” mode before all services were restored.
- Cointribune reported more than 700 accounts affected for at least $2.6 million, while CoinCentral cited DeFi Llama tracking about $2.7 million in losses — the outlets give no single agreed total, and Polymarket has not published a final figure.
- On-chain analysis cited by Cointribune showed 28.6 million POL tokens, valued at about $2.57 million, distributed across several wallets.
- The Polygon blockchain and Polymarket’s core smart contracts were not compromised; the attack ran through a monitoring script supplied by the UK firm DebugBear, which has acknowledged an “ongoing security incident.”
- Cointribune reported an earlier breach in June, when a different third-party provider was compromised and about $3 million was stolen from fewer than fifteen accounts; CoinCentral put that June total at more than $2.9 million.
A tracking script, not a broken chain
According to Cointribune, the first on-chain analyses point to DebugBear, a British company whose Real User Monitoring service uses a script embedded in clients’ pages to measure load times. After that infrastructure was compromised, the script was reportedly replaced or modified to carry malicious code, which checked whether a visitor was logged into Polymarket and then used the active session to sell positions and transfer assets. DebugBear has asked its clients to remove its embedded code.
That distinction matters for how the incident is understood. Attackers did not forge an on-chain transaction or break the prediction market’s contract logic; they hijacked the web layer that prepares and authorizes operations. Researchers at Hudson Rock identified an address in the malicious code that served as the recipient of funds.
Two breaches, one weak point
CoinCentral reported that Polymarket said one of its third-party providers was compromised and that its Predictions Trading API suffered a “major outage,” but the statement did not name the provider. CoinCentral also noted that as of 7:05 pm UTC on Thursday, the platform’s status page showed all systems operational, and identified Shayne Coplan as founder and CEO.
The two incidents follow the same pattern: outside providers, not Polymarket’s own systems, were the entry point. Cointribune puts the combined losses from both episodes at nearly $5.6 million within a few months.
Why it matters
Reimbursement limits the direct financial hit for traders, but it does not restore a position closed during a volatile market to the same state. Users affected by the breach hold their funds on a non-custodial platform, yet a valid session and one compromised script were enough to move their money — a gap that wallet ownership alone does not close. The repeat event shifts scrutiny from a single failing vendor to how Polymarket controls which scripts run on its site.
What to watch
Polymarket has not communicated a final loss figure or the terms of reimbursement, and Cointribune reported that the exact number of victims still has to be determined. How the platform prices compensation — only diverted funds, or also the value of positions sold without consent — is the next concrete detail to track.
Reported by Cointribune.
Sources: Cointribune, CoinCentral