-
Polymarket halted international trading after a compromised DebugBear script exposed user sessions.
-
Trading resumed around 3 p.m. ET, with refunds promised to affected users.
-
Preliminary estimates indicate $2.7 million in withdrawals across 710 wallets; total losses remain unconfirmed.
Polymarket opened trading again on its international exchange on October 29, 2026, after being forced to shut down for a short time due to a compromised monitoring script. The exchange stopped orders, halted relayer activities, and promised customers their money back. The separate US platform was unaffected.
A monitoring script that reached into live trading sessions
Hudson Rock discovered a 15,187-byte malicious payload in DebugBear’s Real User Monitoring script. It was able to gain access to saved account information, find out about authorized clients of traders, and attempt the selling of positions as well as the transfer of tokens.
Polymarket’s website code also showed that the DebugBear script had been removed. The attack appears to have exploited code running on the website, rather than a flaw in its smart contracts.
Cancel-only mode, then a fix by 3 p.m. ET
Polymarket put the international exchange in cancel-only mode on October 29, 2026. Its status account said a provider was compromised and the case had been referred to U.K. law enforcement.
On October 29, 2026, around 3 p.m. ET, trading began again at Polymarket. The company announced its refund policy. As per CNBC’s report, customers who lost below $10,000 are expected to receive their refunds by October 30, 2026. In contrast, the company’s customers who lost over that amount need to sign a release form first. Even though the company communicated its refund plans, it does not confirm that any refunds have been issued.
DebugBear told customers to pull its code
DebugBear also acknowledged a security problem. On October 29, 2026, the company urged customers to remove its monitoring code while specialist responders investigated.
We’re impacted by an ongoing security incident. If you use our RUM product, please remove the embed code from your website.
— DebugBear (@DebugBear) October 29, 2026
The warning highlighted a wider concern. Third-party scripts can run inside legitimate websites. If compromised, they may gain access to users’ active browser sessions.
Preliminary loss estimates versus confirmed losses
For now, the financial damage remains unclear. Betting Intelligence and Polysights traced at least $2.7 million in withdrawals involving 710 wallets on October 29, 2026, CNBC reported.
Meanwhile, Hudson Rock identified about $2.19 million at a fallback recipient address. However, that balance does not establish how much was stolen. Polymarket has yet to confirm the total losses.
Two earlier vendor failures, no shared cause
This wasn’t Polymarket’s first vendor-related security problem. In June 2026, Halborn and TechCrunch reported a malicious-script attack. It reportedly drained around $3 million from at least 11 wallets. Polymarket promised refunds then, too.
Earlier, in December 2025, a separate authentication-provider breach affected users’ accounts. Both Cryptopolitan and CertiK documented the incident.
All three cases involved outside providers. However, there is no evidence linking them to the same attacker or underlying cause.
What repeated vendor exposure means for a $78 billion sector
These repeated incidents come as prediction markets attract more trading activity. An Artemis-derived report recorded $76.46 billion in trading volume across tracked markets in September 2026. Polymarket accounted for $13.12 billion. These figures represent trading activity, not assets held.
That growth brings security concerns into sharper focus. CertiK warns that platforms combining traditional web services with blockchain technology can still have centralized vulnerabilities.
Such risks could also discourage institutional investors. According to Jefferies, hedge funds are showing interest but remain cautious. Liquidity, compliance and reputational concerns continue to hold them back.
Meanwhile, KPMG highlights the different responsibilities of vendors, brokers, exchanges and clearinghouses. U.S.-regulated exchanges must meet surveillance, system-safeguard and participant-protection requirements. However, those rules do not automatically apply to Polymarket International.
For Polymarket, restoring trading is only part of the challenge. The bigger test is whether it can manage risks from outside providers and regain users’ confidence.
The smartest crypto minds already read our newsletter. Want in? Join them.
FAQs
What caused the Polymarket outage on October 29, 2026?
A third-party provider, identified by a CNBC source as website-monitoring firm DebugBear, was compromised, and its script was altered to target logged-in Polymarket traders. The exchange paused trading, fixed the issue and resumed at about 3 p.m. ET.
Which Polymarket users will be reimbursed, and when?
Polymarket told users on Discord that anyone who lost less than $10,000 would have funds restored by October 30, while those who lost more must sign a release form before being repaid.
Was Polymarket's U.S. platform affected by the breach?
No. According to CNBC, only Polymarket's international exchange, which runs on Polygon, was compromised; the U.S. venue stayed operational.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Micah Abiodun
Micah Abiodun makes good use of his Environmental Engineering and Management (MSc) at Tallinn University of Technology (TalTech) to polish content and price prediction news at Cryptopolitan. Now on his 7th year in the crypto media space, he covers major cryptos, altcoins, DeFi, stablecoins, macro trends, and emerging tech.
