The Polymarket hack led the prediction-market platform to suspend trading on October 29, 2026, after unauthorized transactions affected users of its international exchange. Trading resumed about an hour later, and Polymarket said it would fully reimburse affected customers.

Key Takeaways

  • Blockchain intelligence firm Bitquery estimated that $2.73 million was withdrawn from 737 accounts in an hour.
  • Polymarket said a third-party provider was compromised, but has not disclosed a final loss figure or reimbursement timetable.
  • Bitquery identified one additional unauthorized withdrawal after the platform said it had fixed the issue.

Polymarket hack prompted trading suspension

Polymarket put its international exchange into cancel-only mode at 18:05 UTC, allowing users to cancel existing orders but not place new ones. It also suspended relayer operations while investigating. Trading resumed at approximately 19:05 UTC.

The company said it identified and fixed the issue and referred the incident to law enforcement in the United Kingdom. It has not confirmed the number of affected users.

How the withdrawals moved

Bitquery estimated that $2.73 million was withdrawn from 737 accounts between 17:10 and 18:10 UTC. Other investigators’ estimates differed; they are separate observations and should not be added together.

Bitquery’s on-chain investigation describes how withdrawals passed through Polymarket’s own wallet and relayer systems with valid approvals. The firm said it found no broken smart contract, but the blockchain record could not establish who made the approvals.

Security researchers linked the intrusion to DebugBear, a website performance-monitoring provider whose JavaScript tools were embedded in Polymarket’s website. DebugBear acknowledged a security incident and advised customers to remove its Real User Monitoring scripts. Polymarket has not published a complete technical post-mortem.

Reimbursements and a later withdrawal

Polymarket pledged to make affected customers whole, but has not announced when reimbursements will be paid.

Bitquery said it found one additional unauthorized withdrawal at 19:11 UTC, after Polymarket had announced a fix. The firm said it found no other late withdrawal through 19:49 UTC, the limit of its review.

Read More News

More FinanceVelix news

Disclaimer

This FinanceVelix article provides general information, not personalized financial, investment, legal, or tax advice. Market prices, interest rates and economic conditions can change; investments carry a risk of loss. Facts reflect the material available when published and may change. Check important information independently and consult a qualified professional when needed. Mentioning an asset, company, or service is not an endorsement.