Prediction market platform Polymarket temporarily restricted trading on its international exchange after hackers exploited a vulnerability involving a third-party service provider, resulting in losses of at least $2.6 million from user accounts.
The incident occurred on Thursday, October 29, 2026, when users began reporting unauthorised withdrawals and sudden liquidations of funds from their active balances. Some affected users reportedly lost as much as $800,000 in individual incidents.
According to blockchain records and cybersecurity research firm Hudson Rock, the breach originated from a compromised web monitoring script supplied by DebugBear, a UK-based third-party developer.
The attackers reportedly compromised a script embedded in Polymarket’s website frontend. They then used unauthorised code to access active user trading sessions, liquidate open holdings and transfer the converted digital assets into wallets controlled by the attackers.
The incident involved Polymarket’s international platform and affected users whose funds were held in active trading balances.
On-chain analysis conducted by Arkham identified more than 900 malicious transactions that passed through Polymarket’s relayer infrastructure before the funds were exchanged for Polygon’s native POL token.
A relayer is an automated service that helps process and execute user transactions on a blockchain. In this incident, the attackers reportedly used the platform’s relayer infrastructure to move the funds after compromising the website’s frontend dependencies.
Following reports of unauthorised activity, Polymarket administrators quickly restricted operations on the international exchange by switching it to a limited “cancel-only” mode.
The restriction prevented users from opening new positions or executing new orders while allowing them to cancel existing open bids. The company also suspended its backend relayer infrastructure as a precautionary measure to interrupt the attack pathway.
Polymarket subsequently confirmed that its core smart contracts had not been compromised. According to the company, the incident was isolated to external frontend dependencies involving a third-party provider rather than its underlying smart contract infrastructure.
The platform’s technical teams identified and fixed the issue, allowing trading operations to resume approximately an hour after the restriction was introduced.
In a statement posted on October 29, 2026, Polymarket confirmed that one of its external providers had been compromised. The company said it had referred the incident to relevant law enforcement authorities and assured affected users that they would receive full reimbursement for their losses.
Polymarket also confirmed that the matter had been referred to law enforcement authorities in the United Kingdom.
The incident highlights the cybersecurity risks associated with third-party integrations used by digital platforms. Even when a company’s core infrastructure remains uncompromised, external scripts and service providers can create additional security risks if they are accessed by attackers.
For platforms handling financial transactions and digital assets, the incident also demonstrates the importance of monitoring external dependencies, securing user sessions and maintaining safeguards around transaction-processing infrastructure.
