Prediction market operator Polymarket temporarily halted trading on its international exchange Thursday afternoon after a cyberattack on a third-party software vendor led to unauthorized withdrawals from user accounts.
Trading was suspended for roughly an hour before resuming at 3 p.m. Eastern time, the company said. Polymarket confirmed that its international platform, which operates on the Polygon blockchain outside of U.S. regulatory oversight, had been affected, while its separate U.S. exchange remained secure and uncompromised.
Millions drained through vendor software
The disruption was triggered when traders began reporting sudden, unauthorized transfers out of their digital wallets on social media. People familiar with the matter told CNBC and NBC News that the attackers gained entry by compromising DebugBear, a performance-monitoring and analytics provider based in the United Kingdom.
DebugBear acknowledged in a statement on X that it was dealing with an ongoing security incident and advised customers utilizing one of its products to strip its embed code from their websites. DebugBear’s own website was inaccessible for a period on Thursday afternoon.
Blockchain tracking estimates show substantial financial losses. An analysis from analytics firms Betting Intelligence and Polysights provided to CNBC indicated that a single account drained at least $2.7 million across 710 wallets. Separately, crypto news outlet The Block reported that approximately $2.65 million in digital assets was taken, citing data from blockchain intelligence firm Arkham. Polymarket declined to confirm an exact dollar figure.
“This is certainly a significant and new form of breach that we’ve seen on Polymarket,” said Dan Zimmermann, chief intelligence officer at Betting Intelligence. “The timing right before the midterms …is certainly a wake up call for folks.”
Restitution and regulatory turbulence
Polymarket announced on X that it had identified and resolved the issue and referred the incident to British law enforcement authorities. The company repeatedly pledged that all affected customers would be fully reimbursed.
In communications shared in a company Discord channel, Polymarket told users that balances under $10,000 would be restored by Oct. 30, CNBC reported. Customers who lost more than that threshold will be required to sign a release form before their funds are returned.
The breach represents the second vendor-related security issue Polymarket has experienced in recent months, following a similar compromise in June that also required customer refunds. The incident also arrives at a critical juncture for the company, just days ahead of the Nov. 3 U.S. midterm elections, when political prediction wagering typically surges.
Polymarket, which processes roughly $200 million in daily transaction volume, reached a $21 billion valuation in September following a $1 billion funding round led by Donald Trump Jr. The platform and its competitor Kalshi have also been ensnared in legal battles involving state regulators and the federal government over oversight of political event contracts. At the same time, Polymarket continues to examine suspicious activity on its platform; the company’s head of global intelligence and investigations, Shana Bautista, confirmed it is scrutinizing dozens of wagers connected to the upcoming midterms.
