Polymarket hacked again? Millions in crypto affected after third-party security breach
Polymarket, the cryptocurrency-based prediction market platform where people bet on everything from elections to sporting events, has suffered another major cybersecurity incident. Hackers allegedly drained millions of dollars from user accounts after compromising an outside technology provider. The attack forced Polymarket to temporarily suspend trading on its international platform on October 29, 2026.
The platform has since restored trading and promised to reimburse affected users. According to CoinDesk, blockchain data suggests approximately $2.7 million in cryptocurrency was involved in the latest incident. Security researchers believe the attackers used malicious website code to access active trading sessions and move funds without users’ permission.
We’ve identified & fixed an issue impacting our international platform, Polymarket.com. One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement.
Anyone who has been impacted will be made whole.
Out of an abundance of caution, we have temporarily halted trading & are working to bring the platform back online.
— Polymarket Traders (@PolymarketTrade) October 29, 2026
What is Polymarket?
Polymarket is an online prediction market where users trade on the possible outcomes of real-world events. These include elections, sports, economic decisions and international conflicts.
For example, users can buy shares predicting whether a political candidate will win an election. If their prediction comes true, the winning shares pay out. The platform uses cryptocurrency technology to process transactions.
:
What happened in the Polymarket hack?
The trouble began when users reported unexpected withdrawals and cryptocurrency disappearing from their accounts.
According to BleepingComputer, hackers compromised a third-party website monitoring service linked to DebugBear.
The attackers reportedly used malicious JavaScript, a type of code that runs inside web browsers, to interfere with active Polymarket trading sessions.
The code could sell users’ positions and transfer cryptocurrency to wallets controlled by the attackers.
Polymarket temporarily stopped trading for approximately one hour before restoring services.
:
How much cryptocurrency was stolen?
| Details | Reported findings |
|---|---|
| Estimated cryptocurrency affected | Around $2.7 million |
| Amount traced by BleepingComputer | Approximately $2.57 million |
| Platform affected | Polymarket international |
| Trading interruption | Around one hour |
| Official final loss figure | Not disclosed |
| Suspected entry point | Compromised third-party website code |
The reported figures come from independent blockchain analysis. Polymarket has yet to confirm the total financial losses.
:
What has Polymarket said?
In an update on its official status page, Polymarket confirmed that an outside provider had suffered a security breach.
“One of our third party providers was compromised, and we have referred this to relevant law enforcement,” the company said.
Polymarket subsequently announced that trading had resumed, stating, “We’ll make this right and are fully reimbursing all affected traders.”
Who is behind the Polymarket hack?
The attackers remain unidentified.
Security researchers at Hudson Rock reportedly found a suspicious cryptocurrency wallet inside the malicious code. Investigators are examining transactions connected to that wallet.
There is currently no confirmed evidence linking the attack to a specific country or state-sponsored hacking organisation.
:
What happens next?
Polymarket has referred the incident to law enforcement in the United Kingdom.
Investigators will examine how attackers compromised the outside provider and identify affected accounts.
This is not Polymarket’s first security incident in 2026. In June, another third-party breach reportedly resulted in approximately $3 million in user losses.