Polymarket Resumes T...

Polymarket Resumes Trading After Third-Party Breach Drains User Funds

By Aaron Feuerstein October 30, 2026 In Hackers, Polymarket, Trading

Polymarket temporarily restricted trading to order cancellations after a third-party service provider was compromised.
Several users reported unauthorised sales of their positions and losses worth thousands of dollars, although total losses remain unconfirmed.
Researchers identified a suspicious script linked to DebugBear that attempted to access trading tools and transfer positions, but its success remains unclear.
Polymarket restored normal operations, promised to compensate affected users and referred the incident to law enforcement.

What a couple of hours in crypto! The earlier reported Binance hack drained billions in exchange assets, while Binance says user funds are SAFU. Meanwhile, Bitcoin and co. tumble like it’s the end of days. On top of that, Polymarket also suffered a security incident.

Polymarket says it will make affected users whole after one of its outside service providers was compromised, an incident that briefly froze trading on the prediction market on Friday morning Australian time.

The platform went into cancel-only mode, which lets users cancel existing orders but blocks new ones, and by 6:05am AEDT its status page showed all systems operational again. The exchange also paused relayer actions while it investigated.

“Anyone who has been impacted will be made whole,” Polymarket said, adding that it had referred the matter to law enforcement. It hasn’t said how many users were hit or how much was lost.

Users reported unauthorised sales

The problem first surfaced on social media. Several users claimed their accounts had lost thousands of dollars after positions were sold without their consent. Polymarket had earlier logged a major outage affecting its trading API, the interface that connects apps and traders to the exchange.

A suspect script

According to cybersecurity firm Hudson Rock, researchers examined a malicious script linked to DebugBear, a website performance-monitoring service. The code attempted to access users’ trading tools and sell or transfer their positions, but the researchers could not establish whether any transactions succeeded. Polymarket’s statement doesn’t name the provider, and total losses remain unverified.

Polymarket has marked the incident resolved, and its status page is the place to watch for further updates.

Author

Aaron Feuerstein

Aaron Feuerstein is a freelance writer based in Melbourne. His focus is on decentralised finance and the regulatory space surrounding blockchain. He holds a Master's in Accounting. When he is not studying the latest legal case, he enjoys his time as a modest but eager hobby cook.