On 29 October 2026 Polymarket briefly switched its international exchange into cancel-only mode after malicious code drained money from some user accounts. By the evening the problem was fixed, trading was back, and the company had promised that every affected user would be made whole.
If you use Polymarket or were about to sign up, here is what happened, what was not affected and why the incident is less dramatic than the headlines suggest.
Not financial advice. Prediction markets carry a high risk of loss and are restricted in many countries. Figures about the incident come from public reports and may be revised.
What happened
Polymarket’s website loaded a monitoring script from a third-party vendor, DebugBear, used to measure site performance. That script was compromised. According to researchers at Hudson Rock, the malicious version looked for a signed-in user’s active trading session, tried to sell that person’s positions and moved the proceeds to the attacker.
Reported losses range from about 2.6 to 2.9 million dollars, from roughly 700 to 1,000 accounts. One detailed tally counted about 2.73 million dollars from 737 accounts. Polymarket put the international exchange into cancel-only mode, removed the script, and said it had identified and corrected the vulnerability. Trading resumed the same day, and the case was referred to UK law enforcement.
What was not affected
The attack did not touch Polymarket’s smart contracts, the code that holds funds and settles markets. It did not involve stolen private keys or a broken oracle. It was a problem with an outside script on the website that could act only through sessions of users who were signed in at that moment.
The separate Polymarket US app, which runs under CFTC regulation, was reported as not compromised. Users who were not signed in to the international site while the script was live were not exposed to it.
Users are being repaid
Polymarket’s statement was short: “Anyone who has been impacted will be made whole.” One report added that users who lost less than 10,000 dollars would be repaid by 30 October, with larger cases handled individually.
This was not the first vendor problem this year. In June 2026, a compromised third-party dependency also injected malicious code into Polymarket’s frontend and drained about 3 million dollars, and Polymarket then too said it would refund affected users in full. Two incidents in four months are a fair reason for Polymarket to cut back on outside scripts. Both times, though, the damage stayed small relative to the platform’s volume, the hole was closed quickly, and users were promised full repayment.
For scale: on the same day Binance lost about 6.3 billion dollars in a separate hack, more than 2,000 times as much. Our article on the Binance hack covers that case.
Why this is not a reason to stay away
The core of Polymarket kept working. Markets resolve on-chain, your positions are recorded on a public blockchain, and the incident did not change how any market pays out. What failed was one outside script, and Polymarket removed it within hours.
Affected users were promised their money back, and the quick response shows the platform treats these cases seriously. For a trader, the practical risk from incidents like this is lower than the everyday risks of prediction markets: picking the wrong side, thin liquidity and ambiguous market rules. Our guides to Polymarket strategies and the UMA oracle cover those.
How to protect your account
A few habits reduce the risk from any website-level incident:
- Log out when you finish trading. The October script could only act through active sessions.
- Keep on Polymarket only the balance you trade with, and withdraw winnings you do not need there.
- Check your activity history now and contact support through polymarket.com if you see trades you did not make.
- Ignore “refund claim” messages. Scammers copy every incident with fake compensation pages. Polymarket does not ask for your seed phrase or private key.
- Bookmark the official site and use it instead of links from ads or direct messages.
Who can use Polymarket
Polymarket’s international app lists the US, UK, France, Germany, Italy, Poland, Russia, Australia, Brazil, Singapore, Taiwan, Thailand and several Canadian provinces as close-only, and some regions are fully blocked. Using a VPN to get around this breaks the terms of service and can leave funds stuck. US residents have the separate Polymarket US app. Our Polymarket KYC and country guide has the full list.
Bottom line
A compromised vendor script drained about 2.7 million dollars from Polymarket accounts on 29 October. The smart contracts were not hacked, the vulnerability was fixed the same day, and Polymarket has promised to repay every affected user. If Polymarket is available where you live, the incident is a reminder to log out and keep a lean balance, not a reason to avoid the platform.
You can sign up on Polymarket here. That is our referral link; see our affiliate disclosure. This content is for information only and is not financial advice.
Frequently asked questions
Was Polymarket hacked?
Polymarket itself was not breached in the usual sense. On 29 October 2026 a third-party website-monitoring script that Polymarket loaded, from a vendor named DebugBear, was compromised and served malicious code. The code abused the sessions of signed-in users to sell their positions and move the money out. Polymarket's smart contracts were not affected.
How much was lost?
Reports put the losses at about 2.6 to 2.9 million dollars from roughly 700 to 1,000 accounts; one detailed count found about 2.73 million dollars from 737 accounts. Polymarket has not published a final figure.
Will Polymarket refund affected users?
Yes. Polymarket said anyone who was impacted will be made whole. One report said users with losses under 10,000 dollars would be repaid by 30 October. In a similar vendor incident in June 2026, Polymarket also said it would refund affected users in full.
Is Polymarket safe to use now?
Polymarket said it identified and fixed the problem on 29 October, and trading resumed the same day. The vulnerability was in a vendor script on the website, not in the contracts that hold funds and settle markets. No web platform is risk-free, so follow basic steps: keep only the balance you trade with, log out when you are done, and use official links.
Was Polymarket US affected?
No. The incident affected the international platform; the separate, regulated Polymarket US app was reported as not compromised. This content is for information only and is not financial advice.
#Polymarket#hack#security#prediction markets#news#DYOR
Discussion
Loading comments…