Polymarket Restores Trading After Third-Party Breach; $2.7 Million in Suspected Losses

Polymarket restored trading on 29 October 2026 after a breach involving an outside technology provider. The incident affected its international prediction market. The company pledged to reimburse affected customers.

Blockchain analysts estimated losses near $2.7 million. Polymarket has not confirmed that amount. The company also has not disclosed an official affected-user count.

The official incident log marked the disruption resolved at 19:05 UTC. That confirmed service restoration. It did not confirm that refunds had been completed.

What happened to Polymarket?

Users reported unauthorized withdrawals and sales of their trading positions. CoinDesk reported that some users saw their accounts drained.

Polymarket restricted trading while investigating. Users could cancel existing orders, but could not submit new trades. Relayer actions were also paused.

The platform then said an outside provider had been compromised. It reported the issue to law enforcement. Polymarket said it had identified and fixed the problem.

The company identified the international platform as affected. Its announcement did not establish an incident at the separate US exchange. Associated Press reported that trading resumed later that day.

Polymarket hack in numbers

The operational timeline comes from Polymarket. The loss estimates come from outside investigators. They should not be presented as company-confirmed totals.

Timeline of the security response

The status log records a one-hour incident. Service restoration does not establish that every user has been repaid.

Was $2.7 million stolen?

The $2.7 million figure is an outside estimate. WIRED reported that Bubblemaps estimated around 700 affected users. CoinDesk cited a similar DeFiLlama loss estimate.

Other investigators observed roughly $2.65 million in a suspected attacker wallet. These figures are different snapshots. They are not amounts to add together.

Polymarket has not published a reconciled loss total. It also has not published a confirmed number of affected accounts.

How did the breach happen?

Polymarket attributed the incident to a compromised third-party provider. The company did not name that provider in its initial notice.

Reuters reported that the provider was DebugBear. The website monitoring company acknowledged its own security incident. It advised customers to remove embedded monitoring code.

Security researchers found a suspicious browser script. BleepingComputer reported that it targeted active Polymarket sessions. It attempted to sell user positions and transfer cryptocurrency.

That is a research finding. Polymarket has not yet issued a complete technical explanation. The initial point of compromise remains subject to investigation.

Why does a third-party script matter?

Websites often load scripts from outside providers. These can support analytics, monitoring or customer service.

A compromised script may execute inside a visitor's browser. It can sometimes interact with an active session. The harm depends on the site's controls.

This is not necessarily the same as a smart-contract exploit. It also does not prove that private wallet keys were stolen.

Was Polymarket US affected?

The official notice concerned Polymarket.com, the international venue. It did not announce a breach of the separate US exchange.

WIRED reported that the US exchange was unaffected. The two venues should not be confused.

Will affected users receive refunds?

Polymarket said affected traders would be made whole. That is a company commitment.

The official incident log confirms a return to normal service. It does not provide individual reimbursement records.

Users should review their trades and withdrawals. Keep transaction records and contact official support if funds are missing.

Avoid unsolicited messages offering recovery services. Never share wallet secrets or authentication codes.

Is this Polymarket's first security incident?

No. CoinDesk reported a separate third-party incident in June 2026. It involved approximately $3 million in user funds.

The latest case raises questions about vendor access and embedded scripts. A platform can restore trading before investigators finish determining losses.

What can other crypto platforms learn?

External services are part of a platform's security perimeter. Attackers may target those services rather than the exchange itself.

Withdrawal controls and account-session protections matter. So do third-party script reviews and rapid incident response.

Finlazo's proof-of-reserves guide covers another part of exchange risk. Reserves cannot substitute for application security.

Readers can also use Finlazo's crypto exchange directory to research providers.

What happens next?

Polymarket still needs to publish a verified loss figure. It may also disclose how many traders were reimbursed. A fuller technical report could explain how the outside provider was compromised.

For now, the confirmed facts are narrower. Trading was restored on 29 October. Polymarket acknowledged a provider breach and promised refunds.

Reporting cutoff: 30 October 2026. Outside estimates may change. A resolved service incident does not prove all customer claims have been settled.