SECURITY ALERT

The smart contracts held.

The page around them did not.

Polymarket put its international exchange into cancel-only mode for about an hour on Thursday, 29 Oct 2026, after one of its third-party providers was compromised and some users reported funds leaving their accounts, according to the company’s status page and its posts on X.

The company says everyone affected “will be made whole”.

It has not said how many accounts were hit, or how much was taken.

The timeline

At 17:59 UTC, Polymarket’s production site recorded a code change titled “remove debugbear rum script”, according to build metadata found by Hudson Rock.

At 18:05 UTC, the status page reported that the exchange was in cancel-only mode and that relayer actions were paused. A relayer is the service that sends users’ signed transactions to the blockchain; with it paused, traders could cancel orders but not place new ones.

At 18:37 UTC, the status page said Polymarket had “identified and fixed the issue” on Polymarket.com, that “one of our third party providers was compromised”, and that the matter had been referred to law enforcement. The company posted the same message on X.

At 18:55 UTC, it said trading would resume at about 3 p.m. ET.

At 19:05 UTC, the incident was marked resolved. “Trading is now fully back online,” the company posted, adding that it was “fully reimbursing all affected traders”.

So what was the compromised provider doing on a trading page?

How it happened

DebugBear sells a script that measures how fast web pages load.

Hudson Rock says a 15,187-byte file served from a DebugBear address linked to Polymarket did something else. It looked for a logged-in user’s trading session, checked the portfolio, and tried to sell or transfer the holdings.

DebugBear said on X that it was dealing with an “ongoing security incident”, NBC News reported.

Hudson Rock says it has not established how the script was compromised, how long it was served or how many users it reached.

Polymarket said the attack appeared to come from the United Kingdom and that it had referred the case to British authorities, according to NBC. Its US platform did not appear to be affected, NBC said.

If the script ran inside the user’s own session, whose signature moved the money?

Follow the funds

The figures so far are estimates, not reconciled losses.

Arkham data showed a wallet labelled as the suspected attacker’s holding about $2.65 million in POL, Polygon’s native token, after several swaps from USDC.e through the cross-chain service Relay, Decrypt reported.

Suspected attacker wallet (Polygon), per Arkham via Decrypt: 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18

Hudson Rock found that address written into the script itself, as the default destination for stolen funds. Bubblemaps traced about $2.7 million in outflows, according to The Defiant.

Nothing has been reported frozen or recovered.

Polymarket has had vendor trouble before. In June, a compromised vendor led to roughly $3 million in losses across under 15 accounts, all refunded, according to Decrypt.

How many more scripts load on a page that holds a trading key?

Protect yourself

  • If you use Polymarket, check your positions and withdrawal history against your own records and report anything you did not authorise through Polymarket’s official support channels.
  • Be wary of anyone offering “recovery” help in direct messages. Reimbursement comes from the company, not from strangers.
  • Log out of trading sites when you are not using them, so a compromised page has no live session to work with.
  • Keep large balances away from hot trading accounts. A session that can trade can also sell.

This week, Coinbase reported a different vendor problem, contact data exposed through Coinbase’s Amplitude vendor incident. Polymarket’s own surveillance work was in the news on Tuesday: Polymarket’s surveillance of midterm bets. And for why a session or key is worth so much to an attacker, see what a private key can do.

The exchange was audited, monitored and measured.

Who audits the tools doing the measuring?

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.