On this page
Key takeaways
- On October 29, 2026, Polymarket put its international exchange into cancel-only mode and paused relayer actions after users reported assets leaving their accounts without permission. Polymarket then blamed a compromised third-party provider, said it referred the matter to law enforcement, and that anyone impacted will be made whole. Polymarket marked the incident resolved at 3:05 p.m. Eastern, about an hour after trading was paused.
- Polymarket says the issue hit its international platform, Polymarket.com. Its notices don't name its separate U.S. exchange as affected. How many users were hit and the total loss haven't been confirmed; one trader publicly reported losing $800,000.
- The lesson: on a website, code from an outside vendor runs with the same access as the site itself. You can't fully defend against that, but keeping only what you're actively using on any platform limits the damage, and anyone contacting you offering to "recover" lost funds is a scam.
Polymarket, one of the biggest crypto-based prediction markets, stopped new trading on its international site on October 29, 2026, after users said money was leaving their accounts without their approval. Here's what the company has confirmed, what's still unknown, and what it teaches anyone who keeps crypto on a website.
What happened
At 2:05 p.m. Eastern on October 29, Polymarket's status page posted that its exchange was in cancel-only mode, with relayer actions paused, while it investigated an incident. On its status account on X, Polymarket explained that people could still pull existing orders, but nothing new was being matched.
At 2:37 p.m., Polymarket said it had found and fixed the problem on its international platform, Polymarket.com. "One of our third party providers was compromised," the company wrote, adding that it had referred the matter to law enforcement and that "anyone who has been impacted will be made whole." It said it had halted trading out of caution. At 2:55 p.m. the status page said trading would resume at about 3 p.m. Eastern, and at 3:05 p.m. Polymarket marked the incident resolved, with all systems listed as operational.
CoinDesk confirmed that users holding balances on the international platform saw their accounts drained. Decrypt reported that one trader, who posts as CarOnPolymarket, said on X that he lost $800,000. Those are individual reports; Polymarket hasn't given a total.
What researchers say about how it worked
Polymarket hasn't named the provider or published a root cause. Security firm Hudson Rock says a script the site pulled in from DebugBear, an outside service that measures page speed, contained code that hunted for the trading session of whoever was signed in, then tried to sell or transfer that person's assets. Hudson Rock says Polymarket's production site code records the removal of that script, but it hasn't yet worked out how the attack began or how many accounts it reached. Neither Polymarket nor DebugBear had confirmed that finding in the statements we reviewed, and Hudson Rock says its evidence doesn't show that other DebugBear customers were affected.
Decrypt reported that a wallet flagged as the suspected attacker's held roughly $2.65 million worth of POL, the native token of the Polygon network, according to Arkham data. Both of these are third-party findings, not Polymarket statements.
This isn't the first time. Decrypt reported that in June 2026, hackers used a compromised third-party vendor to inject malicious code into Polymarket's site and take roughly $3 million, with fewer than 15 accounts hit, and that Polymarket promised to refund those users in full.
What isn't known yet
- How many people were hit and how much was taken. No official count or total.
- How refunds will work. Polymarket has promised to make impacted users whole but hasn't published the process or timing in the notices we reviewed.
- The root cause. Polymarket hasn't confirmed which provider was compromised or how.
- U.S. users. Polymarket says the issue affected its international platform. Its notices don't name its separate U.S. exchange, and its developer documentation lists the United States as close-only on the international venue.
What it means for you
- Websites run other companies' code. Analytics, chat and monitoring tools load inside the page you're using. If one of those vendors is hacked, its code can act with your logged-in session. You can't check that yourself, which is why the next point matters.
- Keep only what you're actively using on any platform. Money sitting in a trading or betting account is exposed to that platform's mistakes. Our wallets guide explains the difference between platform balances and a wallet you control.
- Read every signature request. If a site suddenly asks you to sign something you didn't start, stop. Some account types may not show a clear prompt at all, which is another reason to keep balances small. Our wallet drainer guide shows what malicious requests look like.
- Ignore "recovery" offers. After every hack, scammers message victims promising to get their money back for a fee. That's a recovery scam. Get updates only from Polymarket's official status page and accounts.
The takeaway
Polymarket says one of its outside providers was compromised, that it fixed the issue on its international site, and that anyone impacted will be made whole. CoinDesk confirmed that users there saw their accounts drained. The size of the losses and the refund details are still open. For everyone else, it's a reminder that a platform balance carries the platform's risk. This is education, not financial advice, and it reflects Polymarket's statements and reporting as of 3:30 p.m. Eastern on October 29, 2026, after Polymarket marked the incident resolved. We'll update this post as Polymarket shares more.
Frequently asked questions
I have a Polymarket account. What should I do?
This is general education, not personal advice. Follow Polymarket's official status page and its official X accounts for updates, not DMs or links from strangers. Polymarket says impacted users will be made whole, but it hasn't published the refund process or a timeline in the notices we reviewed. Be wary of any message offering to speed up your refund or recover your funds.
Was Polymarket's U.S. exchange affected?
Polymarket says the issue affected its international platform, Polymarket.com. Its incident notices don't name its separate U.S. exchange. Polymarket's own developer documentation lists the United States among places restricted to close-only on the international venue.
What does 'cancel-only mode' mean?
Users could pull orders they had already placed, but nothing new was being matched or filled. Polymarket also paused relayer actions, the service that submits users' signed transactions to the blockchain.
How did the attack work?
Polymarket hasn't published a root cause. Security firm Hudson Rock says a script the site pulled in from DebugBear, an outside service that measures page speed, contained code that hunted for the trading session of whoever was signed in, then tried to sell or transfer that person's assets. Hudson Rock says Polymarket's production code records the script's removal, but it hasn't yet worked out how the attack began or how many accounts it reached.
Sources
- Polymarket status: incident notice (October 29, 2026) (opens in a new tab) — Polymarket
- Polymarket Traders statement on X (October 29, 2026) (opens in a new tab) — Polymarket
- Polymarket Status update on X (October 29, 2026) (opens in a new tab) — Polymarket
- Polymarket suspends trading after third-party breach leads to user losses (October 29, 2026) (opens in a new tab) — CoinDesk
- Polymarket Pauses Trading as Prediction Market Investigates Security Incident (October 29, 2026) (opens in a new tab) — Decrypt
- Polymarket breach alert: wallet-draining code found in a third-party script (opens in a new tab) — Hudson Rock
- Geographic restrictions (developer docs) (opens in a new tab) — Polymarket
Published October 29, 2026 by Dave McNaught. Educational content, not financial, legal or tax advice. Spot an error? Request a correction.
Dave McNaught
Dave McNaught has worked in IT since 1999 and founded All Business Technologies (ABT) in 2003, a Boston-area firm providing Managed IT, Cybersecurity, Managed AI, Web Design and App Development. He publishes The Crypto Guide.