Prediction market platform Polymarket temporarily suspended trading on its international website after a cybersecurity breach involving a third-party service provider compromised users’ accounts and enabled hackers to steal millions of dollars in cryptocurrency.
The incident, which occurred on Thursday, October 29, 2026, forced the company to halt trading for approximately one hour while its security team investigated the attack and worked to prevent further unauthorised transactions.
Polymarket subsequently restored trading and assured customers that everyone affected by the breach would be fully compensated.
“We’ll make this right and are fully reimbursing all affected traders,” the company announced in a statement posted on X after trading resumed.
The security breach affected Polymarket.com, the company’s international trading platform, while its separate United States-based platform did not appear to have been affected.
According to the company, the attack originated from the compromise of software supplied by an external service provider whose monitoring tools were integrated into the Polymarket website.
Initial reports identified the compromised provider as DebugBear, a United Kingdom-based company that provides website performance monitoring and analytics services.
The company confirmed on Thursday that it was experiencing an ongoing security incident and advised customers using its Real User Monitoring product to remove its embedded code from their websites as a precaution.
Investigations subsequently established that attackers had replaced a legitimate third-party monitoring script on Polymarket’s website with malicious code designed to target users who were already logged into their accounts.
The compromised software enabled the attackers to exploit active trading sessions, sell users’ prediction-market positions without authorisation and transfer funds out of their cryptocurrency wallets.
Reports of the incident emerged after several users complained on Polymarket’s Discord channel that funds had disappeared from their wallets.
The company initially declined to confirm the extent of the losses but acknowledged that a third-party provider had been compromised.
“One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement,” Polymarket stated.
The company added that it had temporarily suspended trading as a precaution while its technical teams worked to secure the affected platform.
Trading resumed at approximately 3 p.m. Eastern Time on Thursday after the company identified and removed the compromised software.
Polymarket also referred the incident to law enforcement authorities in the United Kingdom, where the affected service provider is based.
Blockchain analysis initially suggested that approximately $2.65 million in cryptocurrency had been diverted from users’ wallets, although Polymarket did not immediately confirm that estimate.
However, in a further update released on Friday, October 30, the company disclosed that approximately $2.7 million had been stolen during the attack.
Polymarket also announced that it would return a total of $3.9 million to affected traders, including an additional $1.2 million to compensate users for losses arising from the temporary suspension of trading and related transactions.
The company explained that the compensation arrangement would cover customers whose positions were forcibly sold or transferred by the attackers, as well as traders who suffered qualifying losses during the trading interruption.
According to Polymarket, affected positions would be compensated based on their value at the time they were taken, including losses arising from the execution of unauthorised sales.
It also said customers who held positions during the trading suspension and suffered losses because markets closed or prices changed during the interruption would receive appropriate compensation.
By Friday afternoon, the company said 95 per cent of affected wallets had already been fully refunded.
Polymarket explained that eligible accounts were identified through blockchain transaction records and internal trading data, meaning affected customers were not required to submit claims to receive their initial reimbursements.
However, users who believed that their losses had been incorrectly calculated or that they had been omitted from the compensation exercise were advised to request a review.
To prevent further exploitation, Polymarket removed the compromised monitoring script, cleared affected website caches, suspended trading and transaction-processing functions, and reset active user login sessions.
The company also announced plans to strengthen its cybersecurity arrangements by introducing stricter controls over third-party software, including enhanced monitoring, software integrity checks and additional restrictions on scripts loaded onto its website.
The incident has renewed concerns about the growing threat posed by cyberattacks targeting third-party technology providers, particularly where malicious software can be distributed through legitimate services used by major financial platforms.
Cybersecurity experts have warned that attackers increasingly exploit weaknesses in external software providers to gain indirect access to larger platforms and their customers.
In Polymarket’s case, the attack demonstrated how compromised website-monitoring software could be used to interfere with authenticated trading sessions and transfer funds without the account holders’ consent.
The breach also occurred at a time when prediction markets were attracting increased attention from investors and regulators.
Polymarket allows users to trade contracts based on the outcomes of political elections, sporting events, economic developments and other future events.
The company was valued at approximately $21 billion in September 2026 following a $1 billion investment by a group of investors led by Donald Trump Jr.
The platform processes an estimated $200 million in trading activity daily, reflecting the growing popularity of prediction markets among retail traders and institutional investors.
However, Polymarket and rival platform Kalshi have faced legal and regulatory disputes over whether trading activities conducted on prediction markets should be regulated by federal authorities or individual American states.
The companies have also faced concerns about suspicious trading activities and the potential misuse of privileged information.
Earlier on Thursday, Bloomberg reported that Polymarket was investigating allegations of suspicious bets connected with Israel’s elections.
The company’s Head of Global Intelligence and Investigations, Shana Bautista, also disclosed that investigations were ongoing into dozens of potentially suspicious bets relating to the United States midterm elections.
Meanwhile, Kalshi separately announced that it was examining suspicious betting activity involving President Donald Trump’s selection of a press secretary.
The investigations are separate from the cybersecurity incident affecting Polymarket’s international platform.
As Polymarket continues working with law enforcement authorities to identify those responsible for the October 29 attack, the company has assured customers that it will cover verified losses and strengthen its security infrastructure to prevent similar incidents.
The company said its trading platform had been restored and that the affected third-party software had been removed, while additional monitoring and security improvements were being implemented.
Post Title: Polymarket Suspends Trading After Cyberattack On Third-Party Vendor, Confirms $2.7 Million Theft, Promises Full Refunds To Affected Users By Naijaonpoint.