The Polymarket hack drained roughly $2.7 million from user wallets on Thursday, October 29, 2026, after attackers compromised a third-party vendor and slipped malicious code into the prediction market's website, hijacking live trading sessions and routing funds to an attacker-controlled wallet. Polymarket halted trading on its international platform for about an hour, fixed the issue, and promised to reimburse every affected trader in full.

The breach landed on the same chaotic afternoon that the world's largest crypto exchange, Binance, saw billions of dollars flow out of its hot wallets, though no source has linked the two incidents. It also landed just five days before the November 3 midterm elections, when Polymarket's election markets are drawing their heaviest traffic of the year.

Key Points

• About $2.7 million in cryptocurrency was drained from Polymarket user wallets on October 29, 2026, according to blockchain trackers and CoinDesk.
• The attack ran through a compromised third-party provider, website monitoring service DebugBear, which injected malicious JavaScript into Polymarket's frontend.
• Polymarket restricted trading to cancel-only mode, paused its relayer, then restored trading after about an hour and pledged full reimbursement.
• The Wall Street Journal reported that hackers accessed funds from more than 700 user accounts; the platform's US-specific service was not affected.
• It is the second vendor-compromise drain on Polymarket in five months, after a nearly identical attack in June 2026 took close to $3 million.

What Happened

Trouble began on Thursday afternoon when Polymarket users started reporting unexpected withdrawals and cryptocurrency disappearing from their accounts. On-chain trackers watched a previously empty address begin collecting funds at around 17:05 UTC. By 17:25 UTC its haul was already about $412,000; by 17:50 UTC it had climbed to roughly $2.02 million; and by 18:05 UTC it stood at approximately $2.68 million.

Polymarket responded by putting its exchange into cancel-only mode, meaning users could cancel orders but could not place new ones, and pausing its relayer, the infrastructure that processes transactions. At 18:37 UTC the company said it had identified and fixed the issue on its international platform, Polymarket.com. Its status page marked the incident as resolved by 19:05 UTC, and trading resumed, with the company saying the halt had lasted roughly an hour.

Blockchain analysts traced roughly $2.5 million of the stolen funds to a single suspect address. The funds were reportedly converted into POL tokens, leaving the receiving address holding around 28.6 million tokens in the early snapshot. Polymarket itself has not published a final loss figure or a count of affected users, and the reported totals remain estimates from independent blockchain analysis.

Background/Context

Polymarket is an online prediction market where users trade on the outcomes of real-world events, from elections and sports to economic decisions and international conflicts. Traders buy shares in a predicted outcome; if the prediction comes true, the winning shares pay out. The platform processes transactions using cryptocurrency technology, and it has grown into one of the most closely watched barometers of election sentiment ahead of the 2026 midterms.

That growth has come with scrutiny. The US Commodity Futures Trading Commission is separately investigating whether Polymarket broke a 2022 settlement by failing to keep American users off its offshore platform, a probe revived in October 2026. The company has also been pushing deeper into the US market, making the security of its trading sessions a live political as well as financial question.

The timing sharpened the story further. Hours before Polymarket's halt, wallets tagged on-chain as Binance hot wallets shed as much as $5.8 billion across Ethereum, Bitcoin and Tron in roughly 40 minutes, from about 20:24 to 21:04 UTC, according to The Block. Binance later confirmed an estimated $6.3 billion impact and said a compromised DevOps engineer's laptop had let an attacker reach a service container and submit unauthorised withdrawals. Binance said user funds were safe and would be covered in full. No source has linked the Binance incident to the Polymarket drain; they were two separate failures on the same afternoon.

Polymarket Hack: How the Vendor Script Worked

According to BleepingComputer and other security reporting, the Polymarket hack did not touch the platform's smart contracts at all. Instead, attackers compromised DebugBear, a website performance-monitoring service whose snippet Polymarket's site loaded. The compromised vendor served malicious JavaScript to visitors of Polymarket's frontend.

Security firm Hudson Rock found that the script read login parameters, proxy wallet addresses and trading API keys from browser storage, hijacking authenticated trading sessions. With that access, the code could sell users' positions and transfer cryptocurrency to wallets controlled by the attackers, all while the users believed they were trading normally.

That distinction matters. The blockchain itself was not broken, and no smart contract was exploited. The weak link was ordinary web infrastructure sitting on top of the crypto rails: a single third-party script with enough reach into live trading sessions to drain them. It is the same pattern security researchers flagged in June 2026, when a nearly identical vendor-compromise attack drained close to $3 million from at least 11 user wallets through an injected frontend script.

Reactions/Quotes

Polymarket addressed users on X through its Polymarket Traders account on October 29: "We've identified & fixed an issue impacting our international platform, Polymarket.com. One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement."

The company added: "Anyone who has been impacted will be made whole." And in a follow-up update it said: "We'll make this right and are fully reimbursing all affected traders."

On the question of who was behind the attack, the company and researchers have been cautious. The attackers remain unidentified, and there is currently no confirmed evidence linking the attack to a specific country or state-sponsored hacking organisation. Hudson Rock reportedly found a suspicious cryptocurrency wallet embedded inside the malicious code, and investigators are examining transactions connected to that wallet.

Polymarket also confirmed that the matter had been referred to law enforcement in the United Kingdom, where DebugBear is based, and stressed that its US-specific platform was not affected by the breach.

Why It Matters

The dollar figure is small beside Binance's multibillion-dollar scare, but the trust question is larger. A prediction market asking ordinary bettors to park money on election outcomes needs users to believe their wallets will still hold money tomorrow. A $2.7 million script-based drain, five days before Americans vote, tests that belief at the worst possible moment.

The repeat pattern is the deeper problem. Twice in five months, a compromised vendor has been able to reach into live Polymarket trading sessions through injected frontend code. That suggests the June incident did not produce a fix strong enough to stop the same class of attack, and it raises questions about how many other third-party scripts sit between users and their funds on platforms that are scaling fast into mainstream use.

There is also a regulatory shadow. With the CFTC already probing Polymarket's handling of US users on its offshore market, a second security incident in a year gives regulators and lawmakers fresh material, and it gives sceptics of election betting a concrete example of what can go wrong when real money rides on a browser session.

What Happens Next

Polymarket's reimbursement process is the immediate next step: the company has promised every affected trader will be made whole, though it has not yet published a final tally of losses or a timeline for payouts. Law enforcement in the UK will examine how the vendor was compromised and trace the attacker-controlled wallets.

Security researchers will also be watching for the company's post-mortem: whether it removes or sandboxes third-party scripts from trading pages, audits every vendor with frontend access, and adds controls so a single compromised snippet cannot read session credentials. Until that account arrives, users can reduce their own exposure by logging out of trading sessions when not active, revoking stale sessions and API keys, and keeping only funds they are actively trading on the platform.

The broader crypto industry will be watching too. Two unrelated failures in one afternoon, one draining millions through a website script and one moving billions through hot wallets, have already renewed calls for exchanges and prediction markets to treat their ordinary web plumbing with the same seriousness as their blockchains. With the midterms days away and election markets at peak volume, Polymarket can expect every trade, and every outage, to be watched closely.

Frequently Asked Questions

How much money was stolen in the Polymarket hack?

Blockchain trackers and CoinDesk put the figure at roughly $2.7 million, with BleepingComputer tracing approximately $2.57 million. Polymarket has not confirmed a final total, so the figure remains an estimate from independent analysis.

How did hackers drain Polymarket wallets?

Attackers compromised DebugBear, a third-party website monitoring vendor, and used it to inject malicious JavaScript into Polymarket's frontend. The script hijacked authenticated trading sessions, sold users' positions and routed funds to an attacker-controlled wallet. Smart contracts were not touched.

Was the US version of Polymarket affected?

No. Polymarket said the issue affected its international platform, Polymarket.com, and that its US-specific platform was not affected by the breach.

Will affected Polymarket users get their money back?

Polymarket has said yes, promising that anyone impacted will be made whole and that it is fully reimbursing all affected traders. It has not yet published a payout timeline.

Is the Polymarket hack connected to the Binance hack?

No confirmed connection exists. The two incidents happened hours apart on October 29, 2026, but they used different methods: a vendor script on Polymarket, and a compromised engineer's laptop reaching a service container at Binance.

Related coverage: Binance Hack Drains $5.7 Billion in Largest Crypto Heist Ever Reported, Binance Suspends Withdrawals for All Users, Confirms $6.3 Billion Hack Impact, and Polymarket CFTC Probe Reopens 2022 Fight Over US Users on Offshore Market.