The Polymarket hack shook the crypto prediction market sector on Thursday, October 29, 2026, when attackers drained user funds from the platform’s international exchange. Polymarket halted trading after reports showed hackers emptied wallets without stealing passwords or seed phrases. The incident puts supply chain security and third party vendor risk back in the spotlight for every Web3 trading platform.
Attackers allegedly hijacked active user sessions, sold positions and withdrew funds directly through Polymarket’s own system. Early reports traced the breach to a compromised website performance monitoring script from DebugBear, a UK based vendor. Trading resumed after roughly one hour.
How the Polymarket Hack Unfolded
Researchers say attackers replaced a trusted DebugBear script with malicious code, and users’ browsers loaded it as normal site content. That code hijacked live trading sessions and triggered transaction approvals that routed crypto to attacker controlled wallets. Polymarket moved its exchange into cancel only mode and paused its relayer to contain the damage. The company confirmed that a third party vendor suffered a compromise, and DebugBear separately reported an ongoing security incident affecting its Real User Monitoring service.
How Much Did Users Lose in the Polymarket Hack?
Loss estimates differ by outlet. BleepingComputer traced about $2.5 million, BusinessToday reported $2.6 million, and Bitcoin.com News cited roughly $2.7 million. Other reports put the total near $3 million, and no official figure has been confirmed. Polymarket says it will reimburse affected users and has referred the incident to UK law enforcement. The same attack pattern also hit the platform in June, when an injected frontend script drained close to $3 million from at least 11 wallets, according to Slashdot.
What the Polymarket Hack Means for Crypto Security
The attack bypassed the core protocol and targeted the website layer that connects users to it. Security analysts warn that auxiliary integrations, such as analytics and monitoring scripts, often escape formal audits even though they sit between users and their funds. Crypto platforms should now audit every third party script, enforce strict content security policies and monitor frontend code for unauthorized changes. Traders should review wallet approvals, revoke suspicious permissions and avoid keeping large balances on trading platforms. Reimbursement may calm users in the short term, but a repeat incident could erode trust in prediction markets long term.
