The world’s biggest prediction market ground to a halt on Thursday night after hackers slipped malicious code onto Polymarket through a compromised third-party script and drained an estimated $2.7 million from users’ wallets in roughly an hour. The Polymarket hack forced the platform to suspend trading on its international exchange, freeze new orders and promise full refunds to every affected trader.
Users began reporting emptied wallets at around 17:30 UTC on 29 October 2026. Within 35 minutes, Polymarket’s status page logged a major outage on its Predictions Trading API — the central limit order book that matches buy and sell orders — and the exchange switched into “cancel-only mode”. Traders could cancel existing orders but could not place new ones, and Polymarket paused its relayer, the service that submits users’ signed transactions to the Polygon blockchain.
Trading halted on Thursday night
Polymarket confirmed the incident in a post from its Polymarket Traders account on X. “We’ve identified & fixed an issue impacting our international platform, Polymarket.com. One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement,” the company said. “Out of an abundance of caution, we have temporarily halted trading & are working to bring the platform back online.”
The exchange stayed in its emergency posture for about an hour. After engineers removed the offending code and verified the fix, trading resumed at around 3:05 p.m. Eastern Time on Thursday (just after midnight in Pakistan), and the incident was marked resolved.
A poisoned website script did the damage
Security researchers at Hudson Rock traced the theft to a JavaScript file served from the infrastructure of DebugBear, a UK-based website performance monitoring company whose Real User Monitoring (RUM) script Polymarket had embedded on its site to measure page loading speed.
Instead of measuring performance, the compromised script went hunting for logged-in trading sessions. Hudson Rock’s analysis found the roughly 15,187-byte payload reading browser storage entries that hold a user’s Polymarket login parameters, proxy wallet address and trading API keys. For accounts connected through a user’s own crypto wallet, the code built a batch transfer that sent position tokens straight to the attacker. For accounts created through Magic, Polymarket’s email-login wallet service, it placed sell orders at progressively lower prices and then tried to move the proceeds out.
The malicious code even carried a fallback recipient address hard-coded inside it. Hudson Rock found production build metadata on Polymarket’s own site with the commit message “chore(polymarket): remove debugbear rum script”, time-stamped 17:59:20 UTC — six minutes before the exchange entered cancel-only mode.
DebugBear confirmed on X that it had been “impacted by an ongoing security incident” and urged every customer using its RUM product to remove the embed code from their websites while specialist responders investigated. The company has not said how its script was compromised, how long the malicious version was served, or how many websites it reached.
At least $2.7 million traced to the attacker
Blockchain investigators put the scale of the theft at roughly $2.7 million. Bitquery analysts traced at least $2.73 million siphoned from 737 user accounts through 985 withdrawal operations executed between 17:10 and 18:10 UTC on 29 October — all routed through Polymarket’s standard infrastructure, which is why the attack was so hard to spot in real time.
The Wall Street Journal reported that a wallet believed to be controlled by the attacker received more than $2.5 million across more than 900 transactions, while Hudson Rock identified about $2.19 million sitting at the fallback address embedded in the malicious script. One trader publicly reported losing around $800,000 in a single account.
Importantly, the breach touched only the website layer. The attack exploited code running on Polymarket.com rather than any flaw in the platform’s smart contracts, and Polymarket US — the company’s separate platform for users in the United States — was unaffected.
Polymarket promises full refunds
Polymarket moved quickly to reassure users. “We’ll make this right and are fully reimbursing all affected traders,” the company posted. According to a CNBC report, customers who lost less than $10,000 were expected to receive their refunds by 30 October 2026.
The company also referred the incident to law enforcement in the United Kingdom, where DebugBear is based. The exact number of affected accounts and the final confirmed loss figure have not yet been disclosed by the company.
The third security scare in five months
The October 29 incident is reportedly the third security event to hit Polymarket in roughly five months — an uncomfortable record for a platform that has become one of the most visible names in crypto, regularly settling millions of dollars in bets on elections, sports and world events.
For users, the episode is a sharp reminder that in crypto, the weakest link is often not the blockchain itself but the ordinary website code sitting around it. A single compromised analytics-style script, loaded by millions of browsers, was enough to turn a routine trading session into a $2.7 million heist.
Sources: Polymarket’s official statement via its Polymarket Traders account; Hudson Rock’s technical analysis of the DebugBear script; reporting by TradingView/Finance Magnates and CyberKendra.
Related Posts
TechnologyPTA Announces 120-Day Tax-Free Mobile Registration for Overseas Pakistanis
TechnologyBinance Hacked: Over $6 Billion Stolen in Biggest Crypto Theft in History
TechnologyECP Proposes AI Labels, Deepfake Ban for Election Campaigns
TechnologyIHC Orders PTA, Pemra, NCCIA to Report on Online Harassment Enforcement as X Compliance Exposed
TechnologyPakistan Climbs Four Places in Global Innovation Index 2026, Regains ‘Overperformer’ Status
TechnologyTikTok Removed 23.2 Million Videos in Pakistan in Just Three MonthsMost Popular
How-ToPTA Tax Calculator 2026: Check Mobile Tax on Any Phone321 views
SportsUEFA Champions League 2026-27: Format, Teams and Schedule312 views
SportsBallon d’Or 2026: London Ceremony, Nominees and All-Time Records Ahead of 70th Anniversary308 views
Canada JobsTech Jobs in Canada: Roles, Salaries, and Skills Needed292 views
Pakistan NewsPIA Boeing 787 Lease Deal: What It Means for the Airline290 views
TechnologyRedmi K100 Launching on 28 October: 10,000mAh Battery, 185Hz Display and Full Specs285 views
