Polymarket pauses trading after hackers drain about $2.7M via compromised third-party script

Prediction market platform Polymarket was hit by an attack on October 29 that reportedly drained roughly $2.7 million from hundreds of user accounts. The company temporarily stopped trading during the incident, and operations have since resumed.

According to reports, the target was Polymarket.com, the crypto-based international exchange, rather than the company's US-facing platform. Attackers are said to have gained access through third-party software, tampering with the JavaScript code that runs on the website. Traders were affected without noticing any change in how they used the site.

The incident has also been linked to DebugBear, a third-party performance monitoring provider. Reports say a modified script hosted by the service let the attackers exploit sessions in which users were already logged in. That gave them access to customer wallets, from which assets were sold or moved to wallets controlled by the attackers. The method means users could lose funds without clicking a phishing link or having their passwords exposed.

Blockchain firms have tried to establish the scale of the losses. Bubblemaps estimated that 700 users on the international platform were affected. Bitquery counted 737 affected users and a stolen total of $2.73 million. BleepingComputer traced about $2.57 million in Polygon's POL token from a wallet suspected to belong to the attacker.

Polymarket has not confirmed how many customers were affected or how much was taken. It did acknowledge the attack and said it would reimburse affected users. The company halted operations for about an hour and has referred the matter to UK law enforcement. DebugBear also acknowledged the incident and asked clients using its Real User Monitoring product to remove the service's embedded code from their websites to prevent further problems.

Separately, the Michigan Gaming Control Board has ordered Polymarket to leave the state's market by November 25, 2026. The decision is another development in the ongoing dispute between state regulators and the prediction markets sector.