Polymarket temporarily shut down trading on its international platform Thursday after hackers drained funds from users’ accounts, turning a compromise at an outside software provider into a major security scare for one of crypto’s most visible prediction markets. Trading resumed after roughly an hour, and the company says affected traders will be reimbursed in full. The incident affected user wallets rather than Polymarket’s core prediction-market contracts.
Polymarket said an unnamed third-party provider had been compromised and that the matter had been referred to law enforcement. Multiple reports identified the vendor as DebugBear, a UK-based website-performance monitoring company whose software was used on Polymarket’s site. The suspected attack appears to have abused code delivered through that outside service, rather than requiring a direct breach of Polymarket’s own trading infrastructure. NBC News reported that the vendor connection was tied to DebugBear. Reuters reported that Polymarket had identified and fixed the issue before restoring service .
The financial damage remains an estimate, but blockchain analysts tracked approximately $2.7 million in withdrawals spread across roughly 700 to 710 wallets. CNBC reported that smaller losses were expected to be restored automatically, while users who lost larger amounts could be asked to complete additional paperwork before receiving reimbursement. The reported transaction analysis placed the total at about $2.7 million . Separate blockchain-security analysis traced millions of POL tokens from the suspected attacker wallet into additional wallets, giving investigators a public trail to follow. BleepingComputer’s analysis tracked roughly $2.57 million in POL transfers .
The episode highlights a risk that extends beyond prediction markets: even when a platform’s main systems remain intact, a compromised analytics, monitoring, advertising, or customer-support tool can become an attack path for users. That danger is especially acute when a website handles crypto wallets or prompts visitors to approve transactions. Early coverage indicated that users’ seed phrases were not exposed, but malicious browser-side code was still apparently capable of redirecting assets from connected accounts. CoinDesk reported that users noticed unauthorized withdrawals before the trading pause .
For Polymarket, the immediate priority is making every affected trader whole and explaining exactly how the vendor compromise reached the international platform. The company has not publicly disclosed a final victim count or complete loss total, and the investigation remains active. Restoring trading quickly limits disruption to live markets, but the reimbursement process and a clearer account of the security controls around third-party code will likely determine whether users view the response as a contained outage or a deeper trust problem.
