Polymarket opened trading again on its international exchange on October 29, 2026, after being forced to shut down for a short time due to a compromised monitoring script. The exchange stopped orders, halted relayer activities, and promised customers their money back. The separate US platform was unaffected.
A monitoring script that reached into live trading sessions
Hudson Rock discovered a 15,187-byte malicious payload in DebugBear’s Real User Monitoring script. It was able to gain access to saved account information, find out about authorized clients of traders, and attempt the selling of positions as well as the transfer of tokens.
Polymarket’s website code also showed that the DebugBear script had been removed. The attack appears to have exploited code running on the website, rather than a flaw in its smart contracts.
Cancel-only mode, then a fix by 3 p.m. ET
Polymarket put the international exchange in cancel-only mode on October 29, 2026. Its status account said a provider was compromised and the case had been referred to U.K. law enforcement.
On October 29, 2026, around 3 p.m. ET, trading began again at Polymarket. The company announced its refund policy. As per CNBC’s report, customers who lost below $10,000 are expected to receive their refunds by October 30, 2026. In contrast, the company’s customers who lost over that amount need to sign a release form first. Even though the company communicated its refund plans, it does not confirm that any refunds have been issued.
DebugBear told customers to pull its code
DebugBear also acknowledged a security problem. On October 29, 2026, the company urged customers to remove its monitoring code while specialist responders investigated.
We’re impacted by an ongoing security incident. If you use our RUM product, please remove the embed code from your website.
— DebugBear (@DebugBear) October 29, 2026
The warning highlighted a wider concern. Third-party scripts can run inside legitimate websites. If compromised, they may gain access to users’ active browser sessions.
Preliminary loss estimates versus confirmed losses
For now, the financial damage remains unclear. Betting Intelligence and Polysights traced at least $2.7 million in withdrawals involving 710 wallets on October 29, 2026, CNBC reported.
Meanwhile, Hudson Rock identified about $2.19 million at a fallback recipient address. However, that balance does not establish how much was stolen. Polymarket has yet to confirm the total losses.
Polymarket DebugBear Breach: Trading Status, $2.7M Loss Estimate and Market Data
Two earlier vendor failures, no shared cause
This wasn’t Polymarket’s first vendor-related security problem. In June 2026, Halborn and TechCrunch reported a malicious-script attack. It reportedly drained around $3 million from at least 11 wallets. Polymarket promised refunds then, too.
Earlier, in December 2025, a separate authentication-provider breach affected users’ accounts. Both Cryptopolitan and CertiK documented the incident.
All three cases involved outside providers. However, there is no evidence linking them to the same attacker or underlying cause.
What repeated vendor exposure means for a $78 billion sector
These repeated incidents come as prediction markets attract more trading activity. An Artemis-derived report recorded $76.46 billion in trading volume across tracked markets in September 2026. Polymarket accounted for $13.12 billion. These figures represent trading activity, not assets held.
That growth brings security concerns into sharper focus. CertiK warns that platforms combining traditional web services with blockchain technology can still have centralized vulnerabilities.
Such risks could also discourage institutional investors. According to Jefferies, hedge funds are showing interest but remain cautious. Liquidity, compliance and reputational concerns continue to hold them back.
Meanwhile, KPMG highlights the different responsibilities of vendors, brokers, exchanges and clearinghouses. U.S.-regulated exchanges must meet surveillance, system-safeguard and participant-protection requirements. However, those rules do not automatically apply to Polymarket International.
For Polymarket, restoring trading is only part of the challenge. The bigger test is whether it can manage risks from outside providers and regain users’ confidence.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.