Polymarket Hacked: How a Hijacked DebugBear Script Drained About $2.7M From Traders

Updated October 30, 2026. This is a live story. Polymarket hasn't published a loss total, a victim count or a post-mortem, so the figures below come from outside analysts and may change.

The Polymarket hack on Thursday, October 29, 2026 didn't come through Polymarket's smart contracts, which the company says weren't compromised. It came in through a small website-monitoring script that Polymarket.com loaded from an outside company, the U.K. firm DebugBear. Someone swapped that script for one that hijacked logged-in traders, sold their positions and moved the money out. Outside analysts put the damage at roughly $2.2 million to $2.7 million, most of them near $2.7 million, spread across about 710 wallets.

Polymarket froze trading on its international platform for about an hour, says the problem is fixed, and has promised to make every affected trader whole. Below: a minute-by-minute replay, how the attack worked in plain English, what's known about refunds, and whether Polymarket is safe to use now.

Polymarket hack: the short version

• What got hit: Polymarket's international platform, Polymarket.com. CNBC reports the company's separate U.S. exchange was not compromised.
• The way in: an outside script. Polymarket says only that "one of our 3rd party providers was compromised." A person familiar with the matter told CNBC it was DebugBear, a website performance monitoring company, and DebugBear itself posted that it was hit by "an ongoing security incident."
• No password needed: according to Hudson Rock, the malicious code reused traders' already-open sessions to sell positions and move funds.
• The damage: about $2.71 million across 710 deposit wallets, according to blockchain security firm GoPlus. Polymarket hasn't confirmed any figure.
• The response: cancel-only mode at 18:05 UTC, trading back about an hour later, and the case referred to law enforcement (in the U.K., according to CNBC's source).
• Refunds: Polymarket says it is "fully reimbursing all affected traders." CNBC reports losses under $10,000 were due back by October 30; bigger ones require a signed release form.
• Not the first time: in June 2026, Polymarket blamed a compromised (never named) vendor for a frontend attack that took about $3 million.

Polymarket hack timeline: replay October 29

Clock times are UTC (Eastern Time was UTC−4 that day). The early dollar figures come from an on-chain watcher's running tally, reported by crypto.news, and haven't been confirmed by Polymarket.

How was Polymarket hacked?

Short answer: through someone else's code running on Polymarket's own website. Security people call this a supply-chain attack. Instead of breaking into the target, the attacker compromises something the target already trusts, and the target delivers the attack for them.

Here is what Hudson Rock and BleepingComputer, which both examined the malicious file, say it did. Hudson Rock notes its findings describe what the code was built to do; its researchers didn't run it.

Step 1: Polymarket's site loaded a script from DebugBear

DebugBear sells website performance monitoring. Its Real User Monitoring (RUM) product works by having customers embed a small piece of JavaScript in their pages. It runs in each visitor's browser and reports how fast the page loads for real people. BleepingComputer found the malicious version was served from DebugBear's own content delivery network (CDN), the servers that hand the file to every visitor.

Step 2: The file was swapped for a drainer

Nobody has said publicly how the attackers got control of that file, or how long the bad version was live. What matters is what happened next. A browser treats an embedded script like part of the website, so the tampered file ran with the same access to the page as Polymarket's own code, for anyone who had the site open.

Step 3: It looked for a logged-in trader

According to Hudson Rock, the code checked whether the visitor was signed in. It read account details the browser had stored, including the wallet address and trading API credentials, and looked for the live trading tools already loaded in the page. That's why a strong password didn't help: the attacker never needed it. The session was already open.

Step 4: It sold positions and moved the money

The script checked each user's balances and prediction-market positions. Depending on how the account was set up, it either sold the positions first or transferred the position tokens directly. It requested signatures and pushed transactions through Polymarket's relayer, the service that submits users' wallet transactions to the blockchain on their behalf. Blockchain analytics firm Arkham counted more than 900 malicious transactions routed that way, according to BusinessToday.

Step 5: DebugBear's servers ran the operation

BleepingComputer found the script also talked to a DebugBear data server, getting instructions and reporting back on targeted accounts, wallet addresses, balances and results. So the vendor's infrastructure was both the delivery truck and the control room. That raises a question nobody has answered yet: how deep inside DebugBear did the attackers get?

Step 6: The cash-out

The proceeds were converted into POL, the native token of the Polygon blockchain that Polymarket's international exchange runs on. BleepingComputer traced about 28.6 million POL, worth roughly $2.57 million, from the attacker's wallet to three more wallets.

What is DebugBear, and why was it on Polymarket?

DebugBear is a U.K.-based service that measures how fast websites load. Companies embed tools like its RUM script to see real visitors' page speeds. The catch is that any script you embed this way can do anything your own code can do on that page.

Polymarket hasn't named DebugBear publicly. The link rests on three things: CNBC's source, the malicious file sitting on DebugBear's servers (found by Hudson Rock and BleepingComputer), and DebugBear's own incident notice. DebugBear's public response so far is a short post on X saying it was "impacted by an ongoing security incident" and telling RUM customers to "remove the embed code from your website." It didn't immediately respond to CNBC.

One detail suggests Polymarket moved fast. Hudson Rock found Polymarket build metadata with the commit message "remove debugbear rum script," timestamped 1:59 p.m. ET (17:59 UTC). That's six minutes before the exchange went into cancel-only mode.

How much was stolen in the Polymarket hack?

Polymarket hasn't said. Every figure below comes from outside analysts reading public blockchain data, and each measures something slightly different:

The spread is normal in the first day of a hack. Some count what left user wallets; others count what sits in one attacker address at the moment they look. About $2.7 million is the most common estimate. GoPlus also points out that addresses don't equal people, so "710 wallets" isn't a confirmed victim count.

On social media, one trader said his account was drained of $800,000. That claim hasn't been verified.

Were Polymarket withdrawals disabled?

Not in so many words. Polymarket didn't announce a withdrawal freeze. At 18:05 UTC, its status page put the exchange in cancel-only mode, meaning traders could cancel open orders but not place or fill new ones, and paused relayer actions. Together, that stopped trading and relayed wallet actions on Polymarket.com for about an hour.

Trading came back at about 3 p.m. ET (19:00 UTC), and the status page marked the incident resolved at 19:05 UTC. CNBC says the halt hit the international platform, and the U.S. platform wasn't compromised.

Will Polymarket users get refunds?

Polymarket's promise is unusually direct. "Anyone who has been impacted will be made whole," it wrote on its status page. On X, it added that it is "fully reimbursing all affected traders."

The details came through Discord, according to CNBC: traders who lost less than $10,000 would have their funds restored by October 30. Those who lost more must sign a release form first. Polymarket hasn't published the release terms, a total payout figure or a formal claims process, and as of this update we found no confirmation that every refund has been paid.

That gap is exactly where scammers move in. Polymarket's statements don't ask anyone to connect a wallet to a new site or share a recovery phrase to get paid. Treat any "refund portal" DM as a trap.

Who hacked Polymarket?

Nobody knows yet. None of the reports we reviewed attribute the attack to a named group, and Polymarket hasn't said who it suspects. It referred the case to law enforcement; CNBC's source said that meant U.K. authorities, because DebugBear is based there.

That makes it different from this week's far larger Binance hack, which has been linked to North Korean hackers. What the two share is the route in: something the platform already trusted (an engineer's laptop at Binance, a vendor's script at Polymarket) rather than a break in its core code.

Has Polymarket been hacked before?

Yes. October 29 is the third Polymarket incident blamed on an outside provider since December 2025, plus one internal key compromise:

Is this the same as the June Polymarket hack?

No. Polymarket confirmed the June incident on June 25, 2026. It said a third-party vendor had been compromised, letting a malicious script into its frontend for some users, and that it had removed the affected dependency and would refund victims in full. PeckShield estimated about $3 million, swapped into roughly 1,893 ETH. Bubblemaps counted fewer than 15 affected accounts, and AMLBot later raised the estimate to $3.1 million.

Polymarket never named the June vendor, so it isn't known whether it was the same company. The two attacks look alike: a script delivered through a trusted vendor, contracts untouched, a same-day refund pledge. The difference is the spread. June took about $3 million from fewer than 15 accounts; October took a similar sum from roughly 710 wallets.

It's also been a rough week for prediction markets generally. Predict.fun confirmed about 400,000 USDT in unauthorized wallet transfers on October 27 and pointed to a possible compromise of an externally hosted API documentation site, according to crypto.news.

Is Polymarket safe now? What to do if you trade there

Polymarket says the issue is fixed, trading is back, and its core smart contracts weren't compromised. As Unchained points out, its last three incidents all came through access points around the platform (a company wallet key, a vendor, an outside provider), not through a reported flaw in its trading contracts. Whether that reassures you depends on how much you trust every company whose code runs on the site.

The timing matters too. CNBC notes both of Polymarket's exchanges are expected to see heavy volume around the U.S. midterm elections on November 3. "The timing right before the midterms ...is certainly a wake up call," said Dan Zimmermann of Betting Intelligence.

Practical steps, mostly from Hudson Rock's guidance:

• If you had Polymarket.com open on October 29, close any tabs that may have been exposed.
• Check your history. Review recent orders and wallet transactions through official channels, and save the transaction hashes. You may need them for a claim.
• Reject signing requests you didn't start. One trader shared a signing prompt marked "Unverified" during the attack. A trusted site can still serve hostile code.
• Ignore refund links in DMs, and never type your seed phrase anywhere.
• Disconnecting isn't undo. It doesn't reverse completed transfers or remove approvals you've already given.
• On Polymarket US? CNBC reports that platform wasn't compromised.
• If you run a website with DebugBear's RUM script, the company's own advice is to remove the embed code.

Spot the risk

Polymarket hack FAQ

Was Polymarket hacked?

Yes. On October 29, 2026, attackers drained funds from users of Polymarket's international platform through a compromised third-party script, reported to be DebugBear's website-monitoring tool. Polymarket confirmed a third-party provider was compromised, halted trading for about an hour and referred the case to law enforcement. Its smart contracts were not reported breached.

How much was stolen in the Polymarket hack?

Polymarket hasn't disclosed a figure. Outside estimates range from about $2.19 million (Hudson Rock, unverified) to $2.71 million (GoPlus). Analysts cited by CNBC counted at least $2.7 million withdrawn across 710 wallets. BleepingComputer traced about 28.6 million POL, worth roughly $2.57 million, to three attacker wallets.

How was Polymarket hacked?

A performance-monitoring script that Polymarket's website loaded from DebugBear's servers was replaced with malicious code. In visitors' browsers, it looked for logged-in traders, read stored account details, sold positions or moved tokens, and pushed transactions through Polymarket's relayer. The proceeds were converted into POL and sent to attacker wallets.

Is Polymarket safe to use now?

Polymarket says the issue is fixed and trading resumed on October 29. The script was removed, and the company says its core contracts weren't compromised. But this is its third incident tied to an outside provider since December 2025. Review your transactions, reject unexpected signing requests, and never share your seed phrase.

Are Polymarket withdrawals disabled?

Polymarket didn't announce a withdrawal freeze. On October 29 it put the international exchange in cancel-only mode and paused relayer actions from 18:05 UTC, which stopped trading and relayed wallet actions for about an hour. Trading resumed around 3 p.m. ET, and the status page marked the incident resolved at 19:05 UTC.

Will Polymarket users get their money back?

Polymarket says everyone affected "will be made whole." According to CNBC, the company told users on Discord that losses under $10,000 would be restored by October 30, and larger losses require signing a release form. Polymarket hasn't published the form's terms or confirmed when all refunds will be complete.

Was Polymarket US affected?

No, according to CNBC. The attack hit the international exchange, Polymarket.com, which runs on the Polygon blockchain and isn't regulated in the U.S. Polymarket's separate U.S. platform was not compromised, and the October 29 status notice described the issue as affecting the international platform.

Is this the same as the June 2026 Polymarket hack?

No. In June, an unnamed vendor's compromise let a malicious script reach Polymarket's frontend, and about $3 million was taken from fewer than 15 accounts, according to PeckShield and Bubblemaps. The October attack was traced to DebugBear's script and spread a similar amount across roughly 710 wallets. Polymarket promised full refunds both times.

Ask anything about the Polymarket hack. Cleus, an uncensored AI, opens this article, searches the live web and gives you a straight answer with sources.

Read next: Binance hack explained: how hackers stole $6.3 billion and the Sony So-net and plala data breach.

Sources

• Polymarket status page: October 29 incident history
• CNBC: Some Polymarket user funds stolen by hackers; exchange referring matter to U.K. authorities
• BleepingComputer: Polymarket halts trading after crypto-draining script breach, $2.5M traced
• DebugBear on X: security incident notice
• Unchained: Polymarket resumes trading, vows to reimburse traders
• Cybersecurity News: Hudson Rock's analysis and user guidance
• crypto.news: Polymarket restricts trading as users report drained wallets
• KuCoin News: GoPlus links Polymarket hack to DebugBear script
• BusinessToday: Hackers drain $2.6 million from Polymarket accounts
• BleepingComputer: Polymarket customers lose $3 million in supply chain attack (June 2026)
• The Next Web: Hackers stole $3 million from Polymarket users through a compromised vendor (June 2026)
• Cointelegraph: Polymarket says third-party provider caused account breaches (December 2025)