TL;DR:
- Amount stolen: On-chain data and reports from The Block indicate that attackers drained approximately $2.65 million across more than 700 affected wallets.
- Attack vector: The breach originated in the monitoring library of a third-party web performance vendor (DebugBear), which introduced a malicious script into the frontend.
- Technical and financial response: The protocol activated “cancel-only” mode at 18:05 UTC on October 29, 2026, and confirmed full reimbursements for affected users.
This Thursday, October 29, Polymarket restored its exchange operations after resolving a security incident that compromised $2.65 million in user funds.
Trading is now fully back online.
We’ll make this right and are fully reimbursing all affected traders.
— Polymarket Traders (@PolymarketTrade) October 29, 2026
The temporary outage began when the company placed its matching engine into “cancel-only” mode. According to a statement released by the company via its X account, the preventive measure halted the execution of new orders while engineers investigated anomalous withdrawals detected within the protocol.
The unusual activity was initially flagged by on-chain analysts and blockchain security firms. Records from Polygonscan and the firm Arkham Intelligence showed concentrated transfers of POL and USDC exceeding $2.65 million, distributed across at least 710 individual wallets.
Polymarket clarified that the underlying smart contracts deployed on the Polygon network suffered no code vulnerabilities. The root cause of the attack stemmed from the compromise of a third-party real user monitoring (RUM) software provider, identified by security researchers as DebugBear.
The script supplied by the third-party vendor contained altered JavaScript code that acted as a wallet drainer by interacting with active sessions on the web interface. Hudson Rock documented that the malicious file was served directly from the provider’s content delivery network (CDN).
Web supply chain attack vector and protocol response
Around 18:00 UTC, DebugBear confirmed it was experiencing an ongoing security incident and requested that its clients remove its integrated code snippets. In parallel, Polymarket’s engineering team removed the external dependency from its production build via an immediate code deployment.
“One of our third-party vendors was compromised, and we have referred this matter to the relevant law enforcement authorities,” Polymarket management stated in its status report. The platform reported the incident to law enforcement authorities in the United Kingdom, the jurisdiction where the monitoring provider operates.
The incident exclusively affected the global domain Polymarket.com, while institutional operations or regulated divisions registered no anomalies, according to sources close to the matter cited by CNBC. The protocol’s custodial contracts maintained the entirety of their collateral reserves intact.
At 18:33 UTC, the company issued a mitigation update guaranteeing that all users who suffered balance losses will receive full financial reimbursement. Management stated it will cover reported losses using corporate funds to avoid imbalances in open market positions.
Approximately one hour after declaring the technical pause, Polymarket’s status monitor marked the incident as resolved at 19:05 UTC. After verifying the stability of the relayers and purging the compromised frontend cache, the order book resumed standard order placement and settlement for prediction contracts.
According to data from Web3 auditing platforms, frontend supply chain attacks represent a recurring technical challenge for decentralized applications that combine autonomous smart contracts with conventional Web2 services.
The protocol stated that it will publish a technical post-mortem in coordination with security firms and assigned law enforcement authorities once forensic investigations conclude.
