Polymarket hack 2026: how a compromised vendor script drained traders on 29 October
Polymarket hack: a vendor script drained traders
Polymarket says one of its third-party providers was compromised on 29 October 2026 and that everyone affected will be made whole. The provider named in research and by its own warning is DebugBear, whose monitoring script carried wallet-draining code; about $2.65 million in POL was traced to one wallet.
Piece published Reviewed by CryptoGuardz Register Desk, editorial desk
Polymarket's status page showed its exchange in cancel-only mode at 18:05 UTC on 29 October 2026, after traders reported funds withdrawn from their accounts without permission. Polymarket said in a post from its @PolymarketTrade (Polymarket Traders) account that one of its third-party providers had been compromised and that anyone affected "will be made whole". About $2.65 million in POL sat in a single wallet, according to Arkham data cited by Decrypt.
Polymarket is a prediction market. The statement refers only to its international platform, Polymarket.com; it does not mention the separate US exchange.
What the document says
Polymarket's statement on X is short:
We've identified & fixed an issue impacting our international platform, Polymarket.com. One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement. Anyone who has been impacted will be made whole. ...
We've identified & fixed an issue impacting our international platform, Polymarket.com. One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement. Anyone who has been impacted will be made whole. Out of an abundance of caution, we…
It does not name the provider. DebugBear, a website performance monitoring service, posted on the same day: "We're impacted by an ongoing security incident. If you use our RUM product, please remove the embed code from your website." The status page logged the outage at 18:05 UTC, saying the exchange was in cancel-only mode with relayer actions paused.
How the drain worked
The researchers at Hudson Rock, as reported by Cybersecurity News and Decrypt, found wallet-draining JavaScript served through a DebugBear script on Polymarket. The code looked for a logged-in trading session, read account details and trading API credentials from the browser, and tried to reuse the session that was already open. Hudson Rock did not run the sample, so this describes what the code was built to do. Depending on the account it tried to move position tokens directly, or to sell positions and then move the funds. A wallet on Polygon, 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18, was hard-coded in the script as its fallback recipient, according to Hudson Rock.
We're impacted by an ongoing security incident. If you use our RUM product, please remove the embed code from your website.
DeFi Prime's reading of that wallet put the first inflow at 17:10 UTC and the last USDC transfer at 18:02 UTC, with 28,636,284 POL held at 18:19 UTC. The Polygon explorer pages were behind a browser challenge for this piece, so that balance is not verified here.
No total has come from Polymarket. Analysis by Betting Intelligence and Polysights, reported by CNBC and cited by Cybersecurity News, linked at least $2.7 million in withdrawals to 710 wallets, and one trader, CarOnPolymarket, said on X that he was drained of $800,000, according to Decrypt. Both are outside figures.
What it changes for users
- The code was designed to work without a password or seed phrase, by reusing a session that was already logged in, through a vendor script embedded on Polymarket.com.
- Polymarket's promise to make users whole is in a post on X. It gives no process or date. CNBC reported that users who lost less than $10,000 were told funds would be restored by 30 October and that larger claims need a release form: not verified against a Polymarket document.
- It is not the first. Decrypt reports that in May a private key compromise drained about $700,000 from an internal top-up wallet, and a month later a compromised third-party vendor let attackers take about $3 million from fewer than 15 accounts; Polymarket promised to refund users in full.
The same day, Binance lost about $6.3 billion from its hot wallets: see what the blockchain shows. For how the platform works, see how Polymarket works.
Quick answers
Was Polymarket hacked?
Polymarket says one of its third-party providers was compromised on 29 October 2026, and DebugBear posted that it was hit by a security incident. Researchers found wallet-draining code in a DebugBear script on Polymarket.com.
How much was stolen from Polymarket users?
Polymarket has not published a total. About $2.65 million in POL sat in one wallet, per Arkham data cited by Decrypt, and an analysis reported by CNBC linked at least $2.7 million in withdrawals to 710 wallets.
Will Polymarket refund users?
Polymarket said on X that anyone impacted will be made whole. It has not published the process or a date.
Sources
- Polymarket Traders on X, statement on the compromised provider, 29 October 2026, retrieved 30 October 2026
- DebugBear on X, security incident notice, 29 October 2026, retrieved 30 October 2026
- Polymarket status page, Predictions Trading API (CLOB) experiencing major outage, 29 October 2026, retrieved 30 October 2026
- Decrypt, Polymarket pauses trading as prediction market investigates security incident, 29 October 2026, retrieved 30 October 2026
- Cybersecurity News, Polymarket hacked, 30 October 2026, retrieved 30 October 2026
- DeFi Prime, Polymarket drained again, 29 October 2026, retrieved 30 October 2026
About this piece
Compiled by the CryptoGuardz register team from the sources listed above. Research and drafting are AI-assisted and reviewed by a named editor before publication. Nothing here is a recommendation to gamble. If a figure or a reading is wrong, tell us and the correction is logged in public.