Polymarket says third-party breach hit international platform; users to receive $3.9 million

Polymarket said a security incident involving an unnamed third-party provider disrupted its international prediction-market platform on Thursday, Oct. 29, and led to unauthorized withdrawals from some users’ wallets. The company paused trading while it addressed the issue, then resumed the service that afternoon. By Friday, Oct. 30, it said it had refunded 95% of affected wallets and would return $3.9 million in total, including compensation for losses associated with the pause.[1][2]

The incident was confined to Polymarket’s international service, according to the company’s account reported by CNBC; its U.S. platform was not compromised. Polymarket said it referred the matter to law enforcement, while early independent reporting offered differing estimates of losses and described a possible malicious-script path. Those technical details and the identity of the provider have not been confirmed publicly by Polymarket in the statements reported by the outlets.[1][2][3]

The episode puts a specific operational risk in focus: a provider integrated into a user-facing service can become a route to user accounts, even when the company says the breach originated outside its own systems. For Polymarket, the immediate response combined a trading pause, a reported fix, and a large reimbursement commitment. The public record at this stage, however, still leaves important details to investigation and independent confirmation.[1][2]

What happened on Oct. 29

Users began reporting unauthorized wallet withdrawals on Thursday afternoon, according to CNBC. Polymarket responded by halting trading on its international exchange. The company said it identified and fixed the issue on its end, and trading resumed at 3 p.m. Eastern Time that day.[1]

The Record reported that Polymarket attributed downtime to a compromise involving an unnamed outside provider. In the statement quoted by the outlet, the company said the matter had been referred to relevant law enforcement. The account is consistent with Polymarket’s public description of a third-party incident, but the provider’s name and the precise intrusion method were not identified in that statement.[2]

Scope limited to the international service

CNBC reported that the incident affected Polymarket’s international exchange and that the company said its U.S. platform was not compromised. That distinction matters: the reports do not describe a compromise across every Polymarket service or establish that the underlying prediction-market contracts or blockchain were themselves breached.[1]

The international platform operates differently from a conventional centralized exchange, but the reporting available here is not enough to infer a wider weakness in its underlying infrastructure. What can be said is narrower: Polymarket identified a provider-related security problem affecting its international platform, stopped trading during response, and later restored service. The company’s account did not publicly disclose the number of affected users.[1][2]

Refunds and pause-related compensation

By Friday afternoon, Polymarket said it had refunded 95% of affected wallets. CNBC reported the company’s stated total return of $3.9 million: $2.7 million for the direct loss amount plus $1.2 million to cover losses associated with the trading pause.[1]

These figures describe the company’s planned or reported returns, not a universally agreed estimate of funds stolen. The additional $1.2 million was described as compensation for pause-related losses; it should not be conflated with the amount withdrawn from wallets during the incident. The sources available do not establish a definitive number of individual victims, and no exact victim count should be inferred from the wallet-return percentage.[1]

Independent estimates differ

Outside researchers and news organizations reported different numbers as they tracked transactions. The Record cited blockchain security researchers who estimated that an account had taken more than $2.1 million in cryptocurrency from users. BleepingComputer reported that researchers traced roughly $2.57 million in transfers to a suspected attacker-controlled wallet, based on blockchain activity.[2][3]

CNBC separately reported that analytics firms Betting Intelligence and Polysights found an account had withdrawn at least $2.7 million across 710 other wallets. These measurements may use different attribution methods and scopes, and the available reports do not reconcile them into a single independently verified loss figure. Polymarket’s $2.7 million direct-loss figure is the company’s own reported component of its refund plan, not proof that every external estimate measures exactly the same thing.[1]

Malicious JavaScript is a reported theory, not a company-confirmed finding

BleepingComputer described a more specific account of the suspected mechanism. It said security researchers linked malicious JavaScript distributed through a third-party service to unauthorized activity involving Polymarket users, and reported that its analysis of the script found it was designed to use authenticated sessions and move or sell assets. It also described the suspected wallet and the approximate value of transfers traced to it.[3]

That reporting offers a plausible technical account, but it remains third-party reporting. Polymarket’s statement, as quoted by The Record, said an outside provider was compromised; it did not publicly confirm the script’s behavior, identify the attacker, or name the provider. Readers should therefore distinguish the company’s stated provider compromise from researchers’ interpretation of transaction and code evidence.[2][3]

DebugBear attribution remains unconfirmed by Polymarket

CNBC reported that a person familiar with the matter identified DebugBear, a website performance-monitoring service, as the affected provider. The outlet also said DebugBear posted that it had been affected by a security incident. BleepingComputer likewise reported researchers’ identification of JavaScript hosted on DebugBear-related infrastructure.[1][3]

Polymarket did not name the provider in the statement cited by The Record, and the company’s public account as reported by CNBC did not itself establish the DebugBear attribution. Accordingly, DebugBear should be described as a reported link, not as a company-confirmed finding or a proven account of responsibility. The same caution applies to claims about the precise route by which the malicious code reached users.[1][2][3]

Law enforcement referral and unanswered questions

Polymarket said it referred the incident to law enforcement, The Record reported. CNBC said a person familiar with the matter told the outlet the referral was to U.K. authorities, given the reported location of DebugBear. The distinction is important: the general referral is attributed to the company, while the specific U.K. destination in CNBC’s account is sourced to a person familiar with the matter.[1][2]

The reports do not provide a final investigation finding, a confirmed attacker identity, or a definitive technical postmortem from Polymarket. They also do not establish an exact number of people affected. As the company returns funds and investigators examine the incident, those unknowns remain central to understanding its full scope.[1][2][3]

What users and platforms should take from the incident

The immediate practical outcome Polymarket reported is that trading resumed and that the company was returning funds to affected wallets, with 95% refunded by Friday afternoon. Its total of $3.9 million combines the direct-loss component and pause-related compensation, rather than representing a single independently confirmed theft estimate.[1]

For platforms that incorporate outside services into customer-facing pages, the incident highlights the potential consequences of a supplier compromise when third-party code is loaded into a live product. That is a general security lesson, not proof that any particular control failed here. A fuller assessment will depend on confirmed technical details from Polymarket or investigators, which the cited reporting had not yet supplied.[2][3]

Sources

CNBC — Some Polymarket user funds stolen, matter referred to UK authorities: https://www.cnbc.com/2026/10/29/polymarket-reports-outage-on-international-exchange-halts-trading.html — company refund figures, service scope and timing; DebugBear attribution and U.K. referral reported with attribution.

The Record — Polymarket confirms cyberattack on third-party provider after outages: https://therecord.media/polymarket-confirms-cyberattack-third-party — company statement and independent loss estimate.

BleepingComputer — Polymarket halts trading after crypto-draining script breach, $2.5M traced: https://www.bleepingcomputer.com/news/security/polymarket-halts-trading-after-crypto-draining-script-breach-25m-traced/ — researchers’ reported script and wallet analysis.