Polymarket Halts Trading After $2.65M Third-Party Breach

Published October 30, 2026, 01:20 AM PKT. Based on Polymarket's own statement on X and its status page on October 29, 2026 (primary source for the halt, the fix and the reimbursement promise), and CoinDesk, Decrypt, Reuters, Cointelegraph and CoinLab reporting on October 29, 2026 (secondary sources). The $2.65 million figure is derived from blockchain data, not a company disclosure, and is labeled as such below.

Polymarket halted trading on its international platform on October 29, 2026, after a third-party provider was compromised and users reported their accounts being drained without approval. The prediction market operator said it had identified and fixed the issue, referred the matter to law enforcement, and would make every affected user whole. Trading resumed after nearly an hour offline, according to multiple reports, but the incident is the second time in recent months that a compromised vendor has cost Polymarket users money, and it lands days after reports that U.S. regulators reopened a probe into the company's earlier settlement with the Commodity Futures Trading Commission.

The halt: cancel-only mode on the international platform

Polymarket announced the breach on Thursday after users reported on X that assets were being withdrawn from their accounts without permission, CoinDesk reported. CoinDesk confirmed that users with balances on Polymarket's international platform saw their accounts drained. The company's status page showed its trading API in a major outage and the exchange in cancel-only mode, Decrypt reported, meaning traders could pull existing orders but could not place new ones, while relayer actions, which submit users' signed transactions to the blockchain, were also paused. At 2:05 PM ET the status page said order cancellations still worked while new trades and relayer actions were paused, CoinLab reported, and at 2:37 PM ET it said one of the company's third-party providers had been compromised and the matter had been referred to law enforcement.

Polymarket's own statement, posted on X, read: "We've identified and fixed an issue impacting our international platform, Polymarket.com. One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement. Anyone who has been impacted will be made whole. Out of an abundance of caution, we have temporarily halted trading and are working to bring the platform back online." The company later added, "We'll make this right and are fully reimbursing all affected traders," according to a subsequent X post cited in reporting. Trading began again at about 3 PM ET after nearly an hour offline, and Cointelegraph reported that as of 7:05 PM UTC the platform said all its systems were operational. The company's U.S.-based platform did not appear to be affected by the breach, according to reporting on the incident.

The $2.65 million trail: swaps into POL

Polymarket has not given a total loss figure of its own, and the $2.65 million number circulating in coverage comes from blockchain analysis, not from the company. Arkham data shows that a wallet identified as the suspected attacker's, 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18, holds about $2.65 million in POL, Polygon's native token, after multiple swaps from USDC.e, a bridged version of the USDC stablecoin, into POL through Relay, a cross-chain swapping service, Decrypt reported. The Block, citing the same Arkham data, reported the same roughly $2.65 million figure. One trader who goes by CarOnPolymarket said on X, "I just got drained $800,000," and added that a friend lost around $600,000, Decrypt reported. Those individual claims are user reports, not company-confirmed losses, and a separate report put the number of drained accounts at nearly 1,000, a figure Polymarket has not confirmed.

The vendor script: DebugBear and the draining code

Polymarket did not name the compromised provider in its own statement, but Reuters reported that a source familiar with the matter identified DebugBear, a website performance monitoring and debugging platform, as the third-party provider involved. DebugBear said in a post on X that it was affected by an ongoing security incident and urged customers using its RUM product to remove the embedded code from their websites, Reuters reported. Security researchers found the mechanism in a DebugBear-associated script: Hudson Rock said a DebugBear-hosted script containing wallet-draining code hard-coded the same suspected attacker address as its fallback recipient, Decrypt reported. Reuters also reported that Polymarket referred the incident to UK law enforcement, a more specific account than the company's own reference to relevant law enforcement. The pattern, a trusted vendor script turned into a drainer inside an authenticated trading app, is why the incident matters beyond the dollar figure: the platform's own contracts were not the point of failure, a component embedded in its website was.

A repeat of the June vendor breach

This is the second time in recent months that Polymarket users have lost funds because a third-party vendor was breached, CoinDesk reported. In June, Polymarket reported that another third-party vendor had been breached, affecting the company's front end, and that breach saw some $3 million in funds taken from users. A separate account put the June theft at $2.94 million stolen from at least 11 wallets. Two vendor compromises in about five months, with the same shape, a compromised third-party component reaching users' funds, is the question Polymarket now has to answer, alongside how many accounts were hit this time and how quickly reimbursements land. The incident also comes two days after reports that the CFTC reopened its probe into Polymarket's 2022 settlement, a probe that had been closed in July 2025 without charges, according to earlier reporting. No new enforcement action has been announced in connection with that probe.

What happens to affected traders

For traders who were drained, Polymarket's commitment is full reimbursement, and the company said trading is back online after the fix. What remains unconfirmed is the scale: the company has not published a loss total, an account count, or a reimbursement timetable, and the $2.65 million Arkham figure is the best public estimate so far. Users who interacted with the site during the incident window should check their balances against their own records and watch for the company's reimbursement notices, and anyone who still has a vendor script or session active from that period should revoke it. The broader lesson, already visible in this week's other vendor incidents across crypto, is that a platform's security is only as strong as the third-party code running inside its own pages.

This article is news reporting and is not investment advice.

Sources

• Polymarket, statement on X and status page, October 29, 2026, primary source for the halt on the international platform, the fix, the third-party provider compromise, the law enforcement referral, and the promise that anyone impacted will be made whole (statement as reported by CoinDesk at coindesk.com)
• CoinDesk, Polymarket suspends trading after third-party breach leads to user losses (October 29, 2026, updated 19:33 UTC), secondary source for the confirmed account drains on the international platform, the status page wording, the trading halt, and the June vendor breach that took about $3 million
• Decrypt, Polymarket Pauses Trading as Prediction Market Investigates Security Incident (October 29, 2026), secondary source for the cancel-only mode and paused relayer actions, the Arkham suspected attacker wallet and its roughly $2.65 million in POL after USDC.e to POL swaps through Relay, the Hudson Rock DebugBear script finding, and the trader reports of $800,000 and $600,000 losses
• Reuters, Polymarket resumes trading after third-party security breach, to reimburse users (October 29, 2026, updated 19:44 UTC), secondary source for the trading resumption, the full reimbursement commitment, the identification of DebugBear as the provider involved, DebugBear's own incident notice, and the referral to UK law enforcement
• Cointelegraph, Polymarket Reported Major Outage, Suspended Trading (October 29, 2026), secondary source for the major outage status, the cancel-only mode, and the 7:05 PM UTC all-systems-operational update
• CoinLab, Polymarket pauses trading after $2.65M exploit (October 29, 2026), secondary source for the 2:05 PM ET and 2:37 PM ET status page timeline, the roughly $2.65 million figure, and the roughly 3 PM ET trading resumption