Prediction market operator Polymarket temporarily halted trading on its international platform on October 29, 2026, after determining that a third-party provider had been compromised. The company stated that it had identified and resolved the underlying problem, referred the matter to law enforcement authorities, and would ensure all affected users received full compensation.
The suspension was implemented as a precautionary step while technical teams worked to restore normal operations.
The disruption was relatively brief.
Platform status updates indicated that the exchange moved into cancel-only mode—allowing existing orders to be withdrawn but blocking new ones—and paused certain relayer functions that process signed user transactions.
These restrictions began around 2:05 p.m. Eastern Time.
By approximately 3:05 p.m. ET, Polymarket reported that trading had fully resumed on Polymarket.com.
Company communications emphasized that the issue had been fixed and that anyone impacted would be “made whole,” with later statements confirming full reimbursement for affected traders.
The firm’s separate U.S. platform was not affected by the incident.
Users on social channels and Discord reported unauthorized activity involving their accounts, including positions being sold and funds transferred without their knowledge.
Independent blockchain analyses estimated the scale of the unauthorized movements at roughly $2.65 million to $2.7 million, concentrated in Polygon’s POL token and involving activity across hundreds of wallets.
Sources familiar with the investigation pointed to a compromise involving DebugBear, a UK-based provider of website performance monitoring tools, specifically its Real User Monitoring product.
DebugBear itself posted that it was experiencing an ongoing security incident and advised clients using the relevant product to remove the associated embed code from their sites.
Cybersecurity researchers later examined a script linked to the provider that appeared designed to interact with active user trading sessions.
Polymarket’s public statements remained measured.
It confirmed the third-party nature of the compromise without naming the provider in its initial posts, stressed that core platform elements had been secured, and reiterated its commitment to reimbursing users.
In follow-up messages after trading resumed, the company stated it would fully reimburse all affected traders and that it had referred the matter to appropriate authorities, including those in the United Kingdom.
Reimbursement timelines varied by amount in some internal communications, with smaller losses prioritized for quicker restoration.
Industry observers described the event as notable.
Dan Zimmermann, chief intelligence officer at Betting Intelligence, characterized it as a significant and novel type of breach on the platform, observing that its occurrence in the period leading into major U.S. midterm elections served as a wake-up call for the sector.
Changpeng Zhao, founder of Binance, publicly suggested the incident appeared consistent with a frontend injection scenario involving the monitoring tool, in which altered transaction details could be presented to users.
Cybersecurity firms such as Hudson Rock analyzed the technical characteristics of the malicious script, highlighting how third-party code loaded into an authenticated interface can inherit the privileges of a logged-in session.
These reactions underscored both the operational response and the systemic exposure created by external dependencies.
Prediction markets have expanded rapidly, drawing retail participants and growing interest from financial institutions seeking exposure to event-driven contracts spanning elections, sports, and geopolitical developments.
The 2024 U.S. presidential election cycle accelerated engagement, and similar dynamics continue.
An incident of this nature, even when quickly contained and accompanied by reimbursement pledges, illustrates the operational and reputational stakes as trading volumes and user bases increase.
Comparable risks are likely to recur across platforms that embed third-party scripts—particularly analytics, monitoring, or customer-support tools—on pages where users maintain active, authenticated sessions.
Supply chain compromises of this kind allow attackers to execute actions that appear legitimate because they leverage existing user permissions rather than directly targeting smart contracts or private keys.
Platforms can reduce exposure by minimizing the number of external scripts loaded on sensitive interfaces, enforcing strict Content Security Policies, applying subresource integrity checks, and conducting regular audits of third-party code.
Isolating authenticated trading functions from non-essential monitoring tools, combined with real-time anomaly detection on session activity and clear user warnings about unexpected transaction prompts, provides additional layers of defense.
Rapid incident response protocols, more transparent communication, and pre-funded reimbursement mechanisms—as demonstrated in this case—help contain both financial and trust-related damage. As prediction markets mature and attract more capital, proactive management of third-party dependencies will remain essential to limiting the impact of similar future events.
