Polymarket halted trading on October 29 after users reported funds leaving their accounts. Shortly after, the team confirmed that attackers compromised one of its third-party providers on Polymarket.com, its international platform. Polymarket promises to make everyone impacted whole and has referred the case to law enforcement.
That’s the short answer. However, a lot is still unclear. Here’s what we know, what we don’t, and what I’d do right now as a Polymarket user.
What Happened on Polymarket Today
The first warnings came from Polymarket’s own community. Around 17:48 UTC, users in the Polymarket Discord said the frontend looked compromised. Money was moving out of accounts without approval. Around the same time, Polymarket trader Car posted on X that he had lost roughly $800,000. He also claimed a friend lost about $600,000.
We spotted the reports early and tweeted a warning right away: stay off the site and don’t sign anything. As always, we alert our community the moment something looks wrong, even before it’s confirmed.
Polymarket reacted fast. At 18:05 UTC, its status page switched the exchange to cancel-only mode and paused relayer actions. In practice, traders could pull open orders but not place new ones. The relayer pushes signed transactions on-chain. As a result, pausing it blocks approvals and transfers routed through Polymarket.
Then came the official confirmation on X. The team said it had found and fixed the issue and traced it to a compromised third-party provider. It also halted trading as a precaution.
How the Attack Worked, as Far as We Know
Polymarket hasn’t named the provider yet. Still, the community has a lead.
One Discord user flagged a script from DebugBear, a website speed-monitoring service, that loaded on the Polymarket homepage. According to that user, the file could grab login credentials and trigger wallet signatures. It could also sell positions and send assets to outside addresses. A normal monitoring script does none of that.
Treat this as a claim for now. Polymarket hasn’t confirmed DebugBear as the source, and the full execution chain isn’t public yet. Even so, it fits a known pattern. A script inside the real site needs no fake URL. Instead, it simply waits for you to connect and sign.
Notably, nothing so far points at Polymarket’s core smart contracts. This was an attack on the website layer, so the danger sat in your browser tab.
Is Your Polymarket Account Safe Right Now?
I have funds on Polymarket myself. Even so, I chose to do nothing. Since this looked like a frontend hack, the safest move was not to touch anything at all.
If you didn’t visit the site or sign anything during the attack window, you’re most likely fine. Polymarket says it fixed the issue. Still, I’d stay careful until trading is fully back and the team publishes a proper post-mortem.
Here’s what I’d do today:
- Don’t connect a wallet or sign anything on Polymarket.com until trading reopens.
- Ignore any “verify your account” or “claim your refund” links. Scammers always follow a hack with fake refund pages.
- If you used a self-custody wallet on the site recently, check your token approvals on Polygon. Revoke anything you don’t recognize.
- If you lost funds, contact Polymarket support through the official site, never through DMs.
For the bigger picture on approvals, drainers and phishing, our airdrop safety guide covers the basics.
Polymarket’s Second Frontend Hack in Four Months
This isn’t the first time. In June, attackers hit a different third-party vendor and injected a drainer script into the Polymarket frontend. Roughly $3.1 million in pUSD left around 11 wallets back then. Polymarket refunded affected users in full. We covered that breach alongside the Polymarket CFTC investigation at the time.
So the obvious question follows. After June, how did another outside script still reach the homepage? Polymarket hasn’t answered that yet.
Meanwhile, the timing hurts. The platform starts moving new markets to its rebuilt Protocol V2 contracts on November 2, just four days from now. On top of that, it’s a busy news week for the brand. Polymarket opened an inquiry into suspicious Israel election bets this week. Just days ago, its 15-minute markets were setting volume records.
What This Means for the POLY Airdrop
Polymarket has confirmed a POLY token and airdrop, though there’s still no date or criteria. A hack doesn’t change that plan. However, the trading halt does pause any volume you were stacking for it.
My take: don’t rush back in to farm. One missed day of volume won’t make or break an allocation, but one bad signature can empty a wallet. Once Polymarket reopens and explains the fix, farming can continue as normal.
You can follow the latest on our Polymarket airdrop listing. For other venues in the sector, discover more on our prediction market airdrops hub.
Traders holding the Polymarket pre-IPO perp should watch this headline too. Our guide on how to buy Polymarket stock explains how that contract tracks the company’s valuation.
What We’re Watching Next
A few big questions are still open:
- Total losses and the number of affected wallets
- The name of the compromised provider, and whether it’s DebugBear
- How and when refunds land
- Whether the Protocol V2 rollout on November 2 stays on schedule
We’ll update this post once Polymarket or on-chain sleuths publish numbers. In the meantime, every hack and breach we track lands in our crypto security coverage.
Keep This Content Free
Hack days are when fast, free coverage matters most, and we want to keep it that way. If you trade on a centralized exchange, signing up through our OKX link or our Bybit link supports our work at no extra cost to you.
Final Words
Polymarket moved fast today. Within about an hour of the first reports, it halted trading, confirmed the breach and promised to make users whole. That’s the right response. Yet a second vendor breach in four months says more about the setup than about one bad day.
Personally, I’m staying off the site until Polymarket explains what broke and how it fixed it. If you hold funds there, do the same. Your POLY farming can wait a day, but a drained wallet stays drained.
FAQ
Was Polymarket hacked?
Yes. On October 29, 2026, Polymarket confirmed that attackers compromised one of its third-party providers on Polymarket.com. The team halted trading and says impacted users will get their money back.
How much was stolen in the Polymarket hack?
There’s no official total yet. One trader publicly claimed a loss of about $800,000. We’ll add confirmed figures once they’re out.
Were Polymarket’s smart contracts exploited?
Polymarket blamed a third-party provider, not its contracts. So far, everything points at the website layer.
Will Polymarket refund users?
Polymarket says anyone impacted will be made whole. After the June frontend hack, it refunded affected users in full.
Is Polymarket US affected?
Polymarket’s statement refers to its international platform, Polymarket.com. So far, it hasn’t said anything about Polymarket US.
Can I trade on Polymarket right now?
Not yet. Trading is halted while the team brings the platform back online. Wait for the official all-clear before signing anything.
Does the hack affect the POLY airdrop?
There’s no sign it does. Polymarket hasn’t changed its token plans, but the halt pauses any volume farming until trading resumes.
