Polymarket temporarily halted trading on its international platform after a third-party provider was compromised. The company said it had identified and fixed the issue, referred the incident to law enforcement and would compensate affected users. Trading was expected to resume around 3 p.m. ET on Thursday, according to the company's announcement.
London's trading industry is coming home!
The suspension followed reports from users that funds had been drained from their accounts. The incident was linked to DebugBear, a performance-monitoring provider whose code was used on Polymarket's website, according to The Wall Street Journal. DebugBear said it was responding to a security incident and advised customers to remove its embedded code.
Attacker's Wallet Receives $2.5 Million From Users
While investigating, Polymarket switched to a cancel-only mode. This prevented users from placing new buy or sell orders but allowed them to cancel existing orders. The company also paused relayer actions as it worked to resolve the problem.
- B2TRADER Adds ChatGPT and Claude for AI Trade Execution, but Brokers Set the Limits
- IG CEO Buys Shares Twice Within a Week After Revenue Outlook Cut; CFO Also Purchases
- FCA Says Only 12% of CFD Firms Changed Charges: How Does Overnight Financing Fees Work?
Polymarket said it had resolved the issue and would make affected users whole. However, it did not disclose the full extent of the incident in its initial announcement. Blockchain activity reviewed by The Wall Street Journal indicated that a wallet believed to be linked to the attacker had received more than $2.5 million from user accounts across more than 900 transactions.
Polymarket paused trading on its website Thursday after some users of the prediction-market’s platform said their accounts had been drained of funds. https://t.co/P8x5w8bvKN
— The Wall Street Journal (@WSJ) October 29, 2026
Third-Party Breaches Raise Financial Platform Risks
The incident follows previous coverage of Polymarket's market-surveillance measures, user trading losses and European regulatory plans. In August 2026, the platform's monitoring programme included blockchain analytics and trade surveillance to identify suspicious activity.
An April report, citing Bloomberg, found that at least 100,000 Polymarket wallets had lost $1,000 or more through trading. In September, a separate report examined the company's efforts to obtain financial status in Europe. In another case involving a third-party provider, Pepperstone disclosed a client data breach but said trading accounts, passwords and bank details were unaffected.
