Polymarket Halts Trading After Vendor Breach Drains $2.65M

Polymarket suspended trading on its international platform on Thursday, October 29, 2026, after a compromised third-party provider allowed an attacker to drain funds from user accounts, Finance Magnates reported. The company said it had identified and fixed the issue, referred the matter to law enforcement and would compensate affected users.

Blockchain Reporter logged the event on Polymarket’s status page at 18:05 UTC on October 29, classified as a major outage affecting the Predictions Trading API. The Wall Street Journal linked the incident to DebugBear, a performance-monitoring provider whose code ran on Polymarket’s website. DebugBear said it was responding to a security incident and advised customers to remove its embedded code.

Also read: Euronext Halts CoinShares Zcash ETP on Paris Debut Day

Key facts

• Polymarket moved to cancel-only mode, letting users pull existing orders while blocking new buys and sells, and paused relayer actions that submit signed transactions to the blockchain.
• Blockchain analytics firm Arkham identified a wallet holding about $2.65 million in POL, Polygon’s native token, according to Blockchain Reporter, which published the address 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18.
• The Wall Street Journal reviewed blockchain activity indicating a wallet believed tied to the attacker received more than $2.5 million from user accounts across more than 900 transactions.
• Security researchers at Hudson Rock said a script loaded from DebugBear searched for a logged-in user’s trading session and attempted to sell positions and transfer assets, Blockchain Reporter reported.
• Polymarket said on X that one of its third-party providers was compromised and that anyone impacted would be made whole.

Two loss estimates, one attacker

The reports agree on the mechanism and the direction of the loss but differ on size. Blockchain Reporter cites the $2.65 million figure from Arkham’s on-chain tracing, while the Journal reports more than $2.5 million across more than 900 transactions. Those figures cover the same suspected attacker, with the gap explained by the different methods — one reading a single wallet balance in POL, the other summing inflows from user accounts.

Victim accounts described publicly point to large balances rather than a sweep of the whole user base. A trader posting as CarOnPolymarket wrote, according to Blockchain Reporter, “If you are a Polymarket user, lock down your account. I just got drained $800,000.” The same user said a friend lost roughly $600,000, and urged others not to interact with the site.

Also read: Bitget Raises Hack Estimate to $387.5M, 83.5% of Protection Fund

A third breach in five months

Blockchain Reporter counted the October 29 event as the third security incident at Polymarket in about five months, following a June vendor breach that drained roughly $3 million and affected fewer than 15 accounts, and a May compromise that drained about $700,000 from an internal wallet. Across the three, Blockchain Reporter put cumulative losses at about $6.35 million, all traced to third-party access rather than the prediction-market protocol itself.

The wider vendor problem extends beyond Polymarket. TheNewsCrypto reported that Coinbase said an incident at analytics provider Amplitude exposed contact data for a small subset of customers, with no evidence of unauthorized access to Coinbase systems and no impact on customer funds. SlowMist’s 23pds claimed more than 70,000 users were affected, a figure Coinbase has not verified. Pepperstone separately disclosed a client data breach while saying trading accounts, passwords and bank details were unaffected, Finance Magnates reported. TheNewsCrypto also noted Bithumb confirming a breach of its internal mobile system and CoinDCX warning of phishing after disclosing a $15.99 million loss.

Why it matters

Prediction markets have spent 2026 moving toward mainstream finance, and a wallet-draining exploit that forces a trading halt gives both users and regulators a concrete case to examine. The make-whole pledge limits immediate damage to users, but the mechanism — a monitoring vendor’s script reaching into logged-in sessions — is one every venue using similar third-party tooling now has to consider. Coinbase’s Amplitude incident shows the same supply-chain pattern reaching customer data at a top exchange, even when funds stay safe.

What to watch

Polymarket has not disclosed how many accounts were affected, how the vendor was compromised, or a timeline for full trading to resume. Its announcement said trading was expected back around 3 p.m. ET on Thursday, while Blockchain Reporter noted the platform was still in cancel-only mode as the investigation continued. Coinbase’s ongoing notifications to customers and regulators over the Amplitude exposure are a separate thread to follow.

None of this constitutes financial advice, and crypto markets remain volatile and uncertain.

Written by

StockPil Editorial

The StockPil Editorial desk covers stock markets, business, finance, forex and crypto. Our AI-assisted newsroom builds each article from published, linked sources, checks it for accuracy before it goes live, and our editors review published articles and correct anything that needs it.

Sources: Finance Magnates, Blockchain Reporter, TheNewsCrypto