Global prediction market platform Polymarket experienced a major security incident on October 29. Some users reported unauthorized transfers of funds from their accounts, prompting the platform to urgently suspend trading.

According to an official Polymarket announcement, the incident stemmed from a breach of a third-party service provider and affected its international trading platform, Polymarket.com. Polymarket later announced that it had fixed the issue and resumed services after suspending trading for about an hour, pledging to fully compensate affected users. However, the actual scale of the losses and the specific attack vector remain unclear.

Image source: X/@PolymarketTrade. According to Polymarket’s official announcement, the incident stemmed from a breach at a third-party service provider.

Polymarket urgently suspended trading and restored service about an hour later.

According to Polymarket’s official system status page, the platform announced at 18:05 UTC on October 29 that it was entering “Cancel-only Mode,” restricting new trading activity while also suspending its transaction relayer service.

The Relayer is primarily responsible for submitting users’ signed transactions to the blockchain. Suspending these functions can reduce the risk of new abnormal transactions while an investigation is underway. About 32 minutes later, Polymarket announced that it had identified and fixed a security issue affecting its international platform, and said that one of its third-party service providers had been breached. The platform temporarily kept trading restrictions in place while it verified that its systems were secure.

Polymarket later announced at 18:55 that it was preparing to restore service, and updated the incident status to resolved at 19:05. In Taiwan time, the trading outage took place from 2:05 a.m. to 3:05 a.m. on October 30 and lasted about an hour.

Polymarket said it had referred the incident to law enforcement and promised to compensate affected traders. The platform has yet to disclose the total number of affected users or a specific compensation timeline.

Suspected attackers controlled about $2.65 million in POL; actual losses remain unconfirmed

According to reports by CoinDesk and Decrypt, following the incident, several Polymarket users said on X that they had noticed unusual activity in their account assets and trading positions, and that some funds had been transferred without authorization.

Blockchain analytics platform Arkham tracked an address flagged as likely being controlled by an attacker that had held about $2.65 million worth of Polygon’s native token, $POL. On-chain records show that the funds were involved in multiple swaps of $USDC.e for $POL. Some transactions were conducted through the cross-chain swap service Relay, after which the funds were gradually transferred to other addresses.

Separately, DeFiLlama’s preliminary loss estimate was about $2.7 million, close to the amount of funds observed by Arkham. However, the figures represent, respectively, the value of assets held by a suspected attacker address and a preliminary estimate of losses. They should not be added together and have not been confirmed by Polymarket.

Third-party monitoring tool DebugBear suspected of breach; malicious code affected trading activity

According to media reports citing people familiar with the matter, the breached third-party service provider was likely DebugBear, a UK-based website performance monitoring company.

DebugBear primarily provides website speed, performance, and user experience monitoring services. Its Real User Monitoring (RUM) tool lets websites embed JavaScript code to collect data on webpage performance and usage.

Following the incident, DebugBear publicly said it was responding to a security incident and advised customers using its RUM product to immediately remove the associated embedded code from their websites.

Cybersecurity research firm Hudson Rock said researchers found suspicious code loaded by DebugBear that appeared capable of identifying Polymarket users who were logged in, attempting to sell their trading positions, and transferring funds to a specified address.

Hudson Rock said the code contained a wallet address suspected to be used by the attacker, consistent with on-chain tracking data. However, it has not yet confirmed how the attacker initially gained access to the system.

Binance co-founder Changpeng Zhao (CZ) also shared an initial analysis on X, suggesting the incident may have involved a frontend injection attack.

Under this theory, the attacker may have manipulated the trading information users saw or the transaction signing process through compromised third-party code, tricking users into approving transactions that differed from what they intended.

However, Polymarket has not published a full technical investigation report, so the specific attack vector remains unconfirmed. There is also no evidence that the underlying blockchain or all smart contracts were compromised.

Another third-party vulnerability incident this year highlights security challenges for prediction markets

This is not the first time a vulnerability in a third-party service has put Polymarket users’ assets at risk.

According to CoinDesk, in June this year, a breach at a third-party provider led to malicious code being injected into Polymarket’s website frontend, affecting fewer than 15 accounts. Polymarket also promised to compensate affected users at the time.

As trading volumes on prediction markets grow, platforms must handle large numbers of trade authorizations, wallet connections, and fund settlements. Third-party code on website frontends has therefore become an important part of security management.

Even if the core trading system is not directly compromised, external code with excessive permissions can still affect users’ trading activity and asset security.

Polymarket has completed initial fixes and resumed trading, but further investigation is needed to clarify how the third-party provider was breached, the scope of affected accounts, and the actual compensation for asset losses.

For the prediction market industry, in addition to the legal and regulatory issues surrounding event contracts, third-party supply chain security, transaction authorization processes, and user asset protection will remain important risk management concerns for platforms.

“Polymarket’s third-party provider breached; trading suspended for an hour, with full compensation promised” was first published on “Crypto City”.