Polymarket restored trading on October 29 after a security incident involving a compromised third-party provider prompted the prediction-market platform to suspend new trading activity and pause relayer operations. Blockchain analytics identified a wallet holding approximately $2.65 million in POL, while reports linked the incident to unauthorized transactions affecting users.
The company said it had identified and fixed the issue, referred the incident to UK law enforcement and would fully reimburse affected traders. Reuters subsequently reported that DebugBear, a website performance-monitoring and debugging provider, was identified as the third party involved by a source familiar with the matter.
The incident raises questions about how malicious code introduced through an external service could affect an authenticated trading platform. Although the suspected attacker wallet provides a significant on-chain lead, the $2.65 million balance should not be treated as a definitive accounting of total customer losses.
Polymarket suspends trading while investigating the incident
Polymarket initially placed its international exchange in cancel-only mode after reports of unauthorized transactions and apparent losses began circulating on October 29. Under this restriction, users could cancel existing orders, but new orders and trades were not being processed. The platform also paused relayer actions while investigating.
The company’s status history records the incident as beginning at 18:05 UTC. At 18:37 UTC, Polymarket reported that it had identified and fixed the issue affecting its international platform. The platform subsequently announced that trading would resume, and its status history marked the incident resolved at 19:05 UTC.
In its incident update, Polymarket said a third-party provider had been compromised and that it had referred the matter to relevant law enforcement. It also committed to making affected users whole.
The subsequent restoration of trading was an important operational milestone, but it did not independently establish the number of affected accounts, the total amount stolen or whether all victims had already received compensation. The reimbursement commitment is a promise to address losses, not confirmation that every payment has been completed.
Polymarket’s official incident timeline and status history records the restriction, investigation, remediation and resolution. The current status page lists the platform’s main services as operational.
On-chain data identifies a suspected attacker wallet
Blockchain analytics platform Arkham identified a wallet associated with the suspected attack that held approximately $2.65 million in POL, Polymarket’s token, after a series of recent swaps from USDC.e through Relay.
The funds subsequently moved to other addresses, according to the on-chain reporting. These transfers provide investigators with potential routes for tracing the assets, although the movement of funds between wallets does not, by itself, establish the identity of the person controlling them.
The reported wallet balance also needs to be distinguished from the total value of losses suffered by users. A balance observed at a particular moment can include assets acquired through multiple transactions, while some stolen funds may already have been transferred elsewhere or converted into other tokens.
Reports placed the suspected losses above $2.5 million, with some estimates approaching $2.7 million. However, Polymarket’s initial incident statements did not provide a complete official loss breakdown or a verified count of affected traders.
The distinction matters because an investigator must establish the origin of funds, identify transactions attributable to affected accounts and avoid double-counting assets as they move between addresses. The suspected recipient’s holdings are an important investigative lead, but they are not a substitute for a complete accounting of the incident.
DebugBear connection points to third-party code exposure
Reuters reported that a source familiar with the matter identified DebugBear as the third-party provider involved. DebugBear offers website performance monitoring and debugging services and said it was dealing with an ongoing security incident. The company urged customers using its Real User Monitoring product to remove the embedded code from their websites.
Additional technical research published by Hudson Rock on October 29 reported finding wallet-draining functionality in a JavaScript file associated with the DebugBear integration. The researchers said the script searched for the user’s active Polymarket trading session and attempted to access portfolio and transaction functionality. They also identified a change in Polymarket’s production build recording the removal of the DebugBear integration.
That research strengthens the case for investigating the third-party script as part of the incident. Nevertheless, the full exposure window, the initial compromise mechanism and the total number of affected users remain unresolved.
The available evidence points toward a security problem involving the website’s application layer and an external dependency, rather than establishing that Polymarket’s underlying smart contracts were directly exploited. This distinction is important: a malicious script operating within a user’s authenticated session can create risks even when the underlying blockchain continues to process transactions normally.
The incident also adds to concerns about the resilience of Polymarket’s trading infrastructure. DaveFinances previously examined a Polymarket trading infrastructure outage and its implications for market signals. The earlier disruption involved a different incident, but both cases illustrate why platform availability and the integrity of the trading interface matter to users interpreting market prices.
Why the incident matters for prediction-market users
Polymarket’s response highlights a difficult security trade-off. Suspending trading can limit further exposure while an investigation is underway, but it also prevents users from opening or adjusting positions during a potentially volatile period. Cancel-only mode allows existing orders to be withdrawn, although it does not itself establish that every account or asset is safe.
Pausing relayer actions adds another layer of containment by restricting a service used to facilitate transactions. The measure can reduce the routes available for certain unauthorized operations, but its effectiveness depends on the underlying attack mechanism and the permissions already available to an attacker.
The broader concern is the trust users place in third-party code. Performance monitoring, analytics, customer-support tools and other external services can become part of a website’s effective security boundary when their scripts execute within an authenticated session. A provider does not need to operate a trading platform itself to create serious exposure if its code can interact with one.
That risk is particularly relevant to cryptocurrency-based prediction markets, where positions and balances may be connected to blockchain wallets and transaction-signing systems. Users can face financial consequences if malicious code persuades them to authorize transfers or obtains access to transaction functionality through an already authenticated session.
Polymarket has also faced user complaints about account restrictions and withdrawal delays. DaveFinances previously covered reports of prolonged Polymarket withdrawal delays and account holds. Those complaints concerned a separate issue and should not be treated as evidence that the latest security incident caused the earlier restrictions. They nevertheless show why clear communication about access to funds is important when users encounter operational problems.
Reimbursement and technical transparency will determine the aftermath
Polymarket’s commitment to reimburse affected users should help address immediate concerns, provided the company follows through and communicates the process clearly. The remaining questions include how victims will be identified, what evidence will be required, how long reimbursements will take and whether the company will publish a detailed post-incident analysis.
Investigators will also need to establish how the compromised provider’s code reached users, which sessions or accounts were affected, and whether any transactions were authorized through deceptive prompts or other mechanisms. A complete technical explanation would help users understand the scope of the incident without assuming that every wallet connected to the platform was exposed.
For traders, the practical lesson is to treat unexpected transaction-signing requests, unexplained position changes and unusual account activity seriously. Users should check official platform announcements, avoid signing unfamiliar requests and verify account activity directly rather than relying exclusively on notifications or screenshots circulating on social media.
For the industry, the episode shows that third-party dependencies can create risks extending beyond the provider’s immediate business. Security reviews need to consider not only whether an external service is reputable, but also what permissions its code receives, how changes are monitored and how quickly the integration can be disabled when suspicious activity emerges.
Polymarket has restored trading and committed to compensating affected users, but the financial and technical aftermath is not yet fully established. The most important next developments will be a verified loss assessment, evidence that affected users have been reimbursed, and a clearer explanation of how the compromised third-party integration enabled the reported activity.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574