Short answer: On October 29, 2026, Polymarket halted trading on its international platform, Polymarket.com, after one of its third-party providers was compromised and attackers drained funds from user accounts. Reports cited by Yahoo Finance and Quartz put the loss at about $2.7 million from more than 700 accounts; Polymarket has not confirmed those figures. The platform switched to cancel-only mode and resumed trading later the same day. Polymarket's US platform did not appear to be affected. The company says anyone impacted "will be made whole".
What happened?
Polymarket said the incident came from a third-party provider, not from its smart contracts. The company did not name the vendor; a source quoted by the Wall Street Journal linked the breach to DebugBear, a UK-based website performance monitoring service. Tools like this are loaded as scripts into a site's pages. If such a script is altered, it runs with the same rights as the site's own code in every visitor's browser and can change what users see and sign.
That is the pattern of a front-end supply-chain attack: the protocol is untouched, but the web page users interact with is not the one the team wrote. It is not Polymarket's first incident of this kind. In an earlier case, a compromised vendor was used to inject malicious code into the front end, taking about $3 million from fewer than 15 accounts.
Key facts
| Item | Detail |
|---|---|
| Date | October 29, 2026 |
| Affected | International platform Polymarket.com; US platform not affected |
| Cause | Compromised third-party provider; reportedly DebugBear (not confirmed by Polymarket) |
| Reported loss | About $2.7 million from 700+ accounts (unconfirmed) |
| Response | Cancel-only mode, trading paused, resumed later that day |
| Compensation | Polymarket says affected users will be made whole |
Why front-end attacks keep working
A modern web app loads code from many places: analytics, error tracking, performance monitoring, chat widgets. Each one is a dependency the site trusts completely. For a crypto app, that trust extends to the moment you sign a transaction or approve a token. A single changed script can swap a destination address or ask for an unlimited approval, and the wallet pop-up will look normal unless you read it carefully. We described similar tricks in address poisoning and signature phishing and in the Coldcard X account hack earlier this month.
How to protect yourself from front-end attacks
- Read every signature. Check the contract, the amount and the recipient in your wallet, not on the web page. Reject anything asking for unlimited approval you did not expect.
- Keep only what you need on platforms. Funds you are not actively using belong in a wallet you control; see self-custody security.
- Revoke old approvals with a token-approval checker every few months.
- Pause when a platform pauses. If a service announces an incident, do not sign anything on it until it confirms the fix.
- Prefer flows with fewer signatures. A swap where you simply send coins to a deposit address and receive the payout at your own address needs no token approvals; compare such services in Changerella App or the exchangers list.
FAQ
Was Polymarket hacked?
A third-party provider used by Polymarket was compromised on October 29, 2026, which let attackers drain funds from user accounts on the international platform. Polymarket's smart contracts were not reported as the cause.
How much was stolen from Polymarket users?
Early reports put the loss at about $2.7 million from more than 700 accounts. Polymarket has not confirmed the figure or the number of affected users.
Will Polymarket refund affected users?
Yes. Polymarket said anyone impacted by the incident will be made whole.
Was the US version of Polymarket affected?
According to reports, Polymarket's US platform did not appear to be affected; the halt concerned the international site Polymarket.com.