Key Takeaways
- Polymarket paused international trading for roughly an hour on October 29 after a security breach involving third-party provider DebugBear.
- An estimated $2.65 million was stolen from user wallets, although Polymarket has not confirmed the total losses or number of traders affected.
- Polymarket promised to reimburse all affected traders, but the breach raises fresh concerns about platform security as prediction markets face growing regulatory scrutiny.
Polymarket paused trading on its international prediction market for roughly an hour on Thursday, October 29, after a security incident compromised a third-party provider.
Reports tie the problem to UK-based DebugBear, and the Washington Examiner reported about $2.65 million left user wallets within minutes. Polymarket says every affected trader will be reimbursed, but key questions remain open for bettors.
How the Polymarket Trading Pause Unfolded
According to AP News, Polymarket said it stopped trading “out of an abundance of caution” after it identified and fixed the issue. Trading resumed Thursday afternoon.
The exchange switched to cancel-only mode during the pause. That meant traders could pull open orders, but couldn’t place new ones. Polymarket also paused relayer actions, the background service that submits transactions for users.
Some users claimed that funds had been withdrawn from their accounts without permission. Polymarket has since referred the incident to a law enforcement agency in the United Kingdom.
What Went Wrong With the DebugBear Script
DebugBear is a website performance monitoring company. Its site was unavailable Thursday afternoon, and the company posted on X that it was “impacted by an ongoing security incident.”
DebugBear told clients using one of its products to remove the embed code from their websites.
Hudson Rock examined the DebugBear-hosted Real User Monitoring script. It found code that searched for a logged-in user’s trading session. The code then tried to sell that user’s positions and move their assets.
Polymarket’s smart contracts were never touched. Instead, the script used trading permissions that victims’ browsers already held. Polymarket’s website code now shows the DebugBear script has been removed.
What’s Confirmed and What Isn’t
The reporting so far mixes company statements with third-party estimates. Here’s how the key details stack up:
| Detail | Status |
|---|---|
| International trading paused for about an hour | Confirmed by Polymarket |
| Full reimbursement for affected traders | Promised by Polymarket |
| About $2.65 million taken from user wallets | Reported, not confirmed by Polymarket |
| Suspected attacker wallet holds about $2.65 million in POL | Blockchain data estimate |
| Number of traders affected | Unknown |
| Total losses | Not confirmed |
It was not immediately clear how many traders were affected or how widespread the damage was. Until Polymarket publishes its own figures, treat the $2.65 million number as an outside estimate.
What the Breach Means for Prediction Market Bettors
Polymarket posted on X, “We’ll make this right and are fully reimbursing all affected traders.” The company added that anyone impacted “will be made whole.” Neither statement explains how or when repayments will happen.
That gap matters because of how Polymarket’s international platform works. It mostly settles in crypto, and offers users a high level of anonymity. We covered that setup in our look at the prediction market insider trading crisis.
Kalshi, by contrast, operates in the US under the Commodity Futures Trading Commission (CFTC) with identity checks.
If you trade on Polymarket’s international site, a few steps make sense right now. Review your recent positions and transaction history for sales or transfers you didn’t make. Follow Polymarket’s official X account for reimbursement details. Treat unofficial refund offers in direct messages as likely scams. Finally, keep only the balance you need for active trades on any crypto platform.
The incident also shows a risk many bettors overlook. This is the third incident involving an outside provider since December 2025. A platform’s own code can hold up while a vendor’s script becomes the weak point.
Regulatory Pressure on Polymarket Was Already Building
The breach arrives during a rough year for prediction markets. In May 2026, House Oversight Chair James Comer opened a congressional investigation into Kalshi and Polymarket over insider trading concerns.
The state fights have mostly targeted Kalshi. In April 2026, a Nevada court barred Kalshi from operating without a gaming license, and the state extended its Kalshi ban. Also, Utah filed criminal charges against Kalshi and its founders.
None of the sources covering Thursday’s incident report any regulatory response to it so far. Still, a reported $2.65 million loss on this platform hands critics a fresh example as lawmakers weigh how to handle the sector.
Why the Polymarket Incident Matters for Bettors
Thursday’s pause shows that platform security extends to every outside vendor whose code runs on the site.
Watch whether Polymarket delivers on its reimbursement promise, and whether Congress folds the breach into its existing probe.
You must be logged in to comment. Don't have an account? Sign up today.