Polymarket restores trading after supplier compromise, with losses still unconfirmed
Polymarket has restored trading on its international exchange after a third-party provider was compromised, and says it will reimburse affected traders. The halt lasted about an hour. It left open how much money was taken, how many users lost funds and whether the reported role of a web-monitoring supplier explains what happened.
Statements from the company, relayed through secondary reports, said it had identified and fixed an issue affecting Polymarket.com, that one of its third-party providers had been compromised and that the matter had been referred to law enforcement. Polymarket said affected users would be made whole, then that it was fully reimbursing all affected traders. It has published no official loss total or victim count.
What Polymarket confirmed
Reported timelines put the disruption on a Thursday afternoon US Eastern time. Some source metadata dates it to 28 October 2026; HKET and BleepingComputer place it on Thursday 29 October. HKET said users began reporting unauthorised withdrawals at about 1.30 p.m. BleepingComputer reported that the exchange moved to cancel-only mode at 2.05 p.m., allowing traders to cancel orders but not submit new ones, and paused relayer actions. Polymarket announced a fix at 2.37 p.m. Trading resumed around 3 p.m., and the outlet recorded the incident as resolved at 3.05 p.m.
TODAY.com reported that the US-based platform did not appear to be affected. HKET went further, stating that it was not affected and describing the international exchange as running on the Polygon blockchain outside US regulation. Both are secondary accounts; no published company incident report was available.
How the supplier link emerged
Polymarket’s statements did not name the supplier. Multiple outlets, citing unnamed people familiar with the matter or a source with knowledge, identified DebugBear, a website performance-monitoring service whose Real User Monitoring product relies on JavaScript embedded in customers’ sites. DebugBear confirmed it was dealing with an ongoing security incident and told RUM customers to take the embed code off their sites.
That confirmation shows DebugBear was responding to a security incident. It does not establish, on its own, that the same incident caused Polymarket’s losses. The causal link rests on unnamed sourcing and on technical analysis published by BleepingComputer, which cited Hudson Rock and examined a copy of the malicious JavaScript.
BleepingComputer reported that the script checked whether a visitor was logged into Polymarket, then tried to use the existing session and the platform’s trading functions to liquidate positions and move cryptocurrency or other assets to an attacker-controlled wallet. The script also communicated with a DebugBear domain for instructions and for data about targeted accounts, wallet addresses, balances and transaction results. BleepingComputer, citing Hudson Rock, reported build metadata showing that Polymarket had removed the DebugBear integration at 1.59 p.m. ET, shortly before the company’s public announcement.
Even so, the reports describe a capability rather than a complete post-mortem. How DebugBear was first compromised, how far attackers reached into its systems and how many users were affected all remain unknown. Nothing in the published material suggests a flaw in RUM services generally. What the case does show is front-end supply-chain risk: a script embedded across a site runs inside visitors’ browsers, so a supplier compromise can produce losses within a logged-in session even when the platform’s core systems hold. Where responsibility divides between vendor and platform has not been established.
Why the loss estimates diverge
No single loss figure is official. BleepingComputer traced about $2.5 million to a suspected attacker wallet and reported that roughly 28.6 million POL, valued at about $2.57 million, had been transferred to three other wallets. Quartz, citing The Wall Street Journal’s wallet analysis, reported more than $2.5 million taken through more than 900 transactions, and about $2.65 million in POL then sitting in the same wallet according to Arkham data relayed by Decrypt. HKET reported at least $2.7 million, citing analytics firms.
These numbers measure different things at different moments: funds traced into a wallet, tokens moved onward and a balance still held. They are third-party estimates rather than an audited reconciliation, and they should not be added together as though each were a separate loss. Polymarket has not said how many users were affected. HKET, citing analysis by Betting Intelligence and Polysights provided to CNBC, reported that one Polymarket account withdrew at least $2.7 million through 710 other wallets. That is a description of a movement pattern, not an official victim count.
Refunds and earlier incidents
Reimbursement statements are a commitment, not proof that every affected trader has been repaid. BleepingComputer reported at the time that Polymarket had not disclosed how many users were affected, how much cryptocurrency had been stolen or how the process would work. HKET later relayed Discord guidance that losses below $10,000 would be restored by 30 October, while larger losses required a release form. That detail reached HKET through CNBC and ChainCatcher and was not confirmed against a primary Polymarket statement.
The incident sits alongside earlier, separate losses. Quartz, citing Decrypt, reported that about $700,000 was drained from an internal top-up wallet in May 2026 after a private key compromise, and that about $3 million was taken from fewer than 15 accounts in June 2026, when attackers used a compromised third-party vendor to insert malicious front-end code. Polymarket pledged full refunds after the June incident. The repetition makes supplier exposure a fair question, but it does not show that October shared the same root cause, the same supplier or the same attackers.
What remains unresolved
No account explains how DebugBear’s systems were first compromised. No named individual or group has been identified, and the evidence does not fix the attackers’ location. TODAY.com reported that Polymarket said the attack appeared to emanate from the United Kingdom, but the other UK references attach to DebugBear’s headquarters and to the law enforcement referral, not to a verified attacker location. No public confirmation from UK law enforcement was available.
The reports identify no CVE, severity score or fixed software version. Removing the third-party integration was containment, not a patch for a named flaw. DebugBear’s removal advice covered every site running its monitoring code, but how many other sites were affected has not been established.
The distinction that matters now is between containment and resolution. Polymarket had restored trading and, on the reported evidence, removed the supplier script. It had not published an audited loss total or victim count, and completion of reimbursements remains unverified. Three records would settle much of this: a company statement accounting for losses and repayments, a supplier incident report explaining the initial compromise, and law enforcement confirmation that a referral was received. Until then, the estimates in the low millions are overlapping snapshots of one reported incident, not a settled bill.
When reports describe an embedded script sitting between a trading interface and a logged-in session, the useful question is not simply whether service has resumed, but what evidence separates containment from resolution. Internet vulnerabilities as a subject gives that question a practical frame: how web-delivered code is scoped, why a supplier’s access changes the trust boundary, and how the conditions for a weakness differ from proof of what occurred. Cybersecurity fundamentals add the evidentiary habit of reading an estimate as an estimate rather than an audited total. For readers who want to build that judgement deliberately, The Hack Academy’s online cybersecurity training programme lists internet vulnerabilities and cybersecurity fundamentals among its subject areas, with self-paced learning and practical exercises alongside the theory.