# Polymarket halts trading after a compromised third-party provider drains user wallets through its website · pwn.watch > On Oct 29 2026 Polymarket users reported their accounts being drained after using polymarket.com; one trader said he lost $800,000 and a friend $600,000 (user claims, not confirmed by Polymarket). At 18:05 UTC Polymarket put the exchange in cancel-only mode and paused relayer actions. At 18:37 UTC it said one of its third-party providers was compromised, that it had identified and fixed the issue on Polymarket.com, referred it to law enforcement, and that anyone impacted will be made whole; it then halted trading. At 19:00 UTC Polymarket said trading was fully back online and that it is fully reimbursing all affected traders, and at 19:05 UTC its status page marked the incident resolved. Polymarket has not named the provider or a loss total. The Block, citing Arkham data, reports a suspected attacker wallet holding about $2.65M, and CoinDesk cites DeFi Llama tracking about $2.7M in losses. A person familiar with the matter told CNBC the compromised provider was web-performance service DebugBear and that the case went to UK law enforcement; Hudson Rock told Decrypt a DebugBear-hosted script contained wallet-draining code. Polymarket's US platform was not affected, and no smart-contract exploit has been reported. It is the second time this year: in June, tampered outside-vendor code on the site drained about $3M. If you used the site on Oct 29, check your account for withdrawals you didn't make. Page: https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026 · generated 2026-10-29T20:46:10.933Z ## Status - Severity: high · status: live · patch: patched - Product: Polymarket (polymarket.com) - Started: 2026-10-29 - Affected: polymarket.com (international platform) users who connected or signed on Oct 29 2026 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026.json - This file: https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026/llms.txt ## Updates (newest first) - 2026-10-29T19:05Z: Polymarket's status page marks the incident resolved. (https://status.polymarket.com/history/1) - 2026-10-29T19:00Z: Polymarket says trading is fully back online and that it is fully reimbursing all affected traders. (https://x.com/PolymarketTrade/status/2115881498477785393) - 2026-10-29T18:55Z: Polymarket's status page moves to monitoring: a fix is out and trading will resume at approximately 3pm ET. (https://status.polymarket.com/history/1) - 2026-10-29T18:37Z: Polymarket says one of its third-party providers was compromised, it has identified and fixed the issue on Polymarket.com, referred it to law enforcement, and anyone impacted will be made whole; trading stays halted while the platform is brought back online. (https://status.polymarket.com/history/1) - 2026-10-29T18:05Z: Polymarket's status page reports a major outage: the exchange is in cancel-only mode and relayer actions are paused while it investigates an incident. (https://status.polymarket.com/history/1) - 2026-10-29T17:45Z: A Polymarket trader posts that $800,000 was drained from his account, all his positions were sold and a friend lost $600,000, and warns users not to interact with the site. (https://x.com/CarOnPolymarket/status/2115862718452298234) - 2026-10-29: The Block reports, citing Arkham data, that a wallet identified as the suspected attacker holds about $2.65M in POL after USDC.e-to-POL swaps through Relay; CoinDesk says DeFi Llama tracks about $2.7M in losses. (https://www.theblock.co/news/defi/2026-10-29-polymarket-exploit-2-5-million-cancel-only-mode-432158) - 2026-10-29: Hudson Rock tells Decrypt a script loaded from DebugBear contains code that looks for a logged-in trading session, sells positions and transfers the assets, with the suspected attacker wallet hard-coded as fallback recipient. (https://decrypt.co/382185/polymarket-pauses-trading-prediction-market-security-incident) - 2026-10-29: A person familiar with the matter tells CNBC the issue stemmed from a hack of DebugBear and was referred to UK law enforcement; analytics firms told CNBC an account withdrew at least $2.7M across 710 wallets. Polymarket's US platform was not compromised. (https://www.cnbc.com/2026/10/29/polymarket-reports-outage-on-international-exchange-halts-trading.html) ## Fix brief # Security brief: Polymarket halts trading after a compromised third-party provider drains user wallets through its website Source: https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026 · status: live · severity: high · updated Oct 29, 2026, 20:43 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is On Oct 29 2026 Polymarket users reported their accounts being drained after using polymarket.com; one trader said he lost $800,000 and a friend $600,000 (user claims, not confirmed by Polymarket). At 18:05 UTC Polymarket put the exchange in cancel-only mode and paused relayer actions. At 18:37 UTC it said one of its third-party providers was compromised, that it had identified and fixed the issue on Polymarket.com, referred it to law enforcement, and that anyone impacted will be made whole; it then halted trading. At 19:00 UTC Polymarket said trading was fully back online and that it is fully reimbursing all affected traders, and at 19:05 UTC its status page marked the incident resolved. Polymarket has not named the provider or a loss total. The Block, citing Arkham data, reports a suspected attacker wallet holding about $2.65M, and CoinDesk cites DeFi Llama tracking about $2.7M in losses. A person familiar with the matter told CNBC the compromised provider was web-performance service DebugBear and that the case went to UK law enforcement; Hudson Rock told Decrypt a DebugBear-hosted script contained wallet-draining code. Polymarket's US platform was not affected, and no smart-contract exploit has been reported. It is the second time this year: in June, tampered outside-vendor code on the site drained about $3M. If you used the site on Oct 29, check your account for withdrawals you didn't make. Severity detail: User wallets drained via the website; about $2.65-2.7M drained per on-chain trackers cited by The Block and CoinDesk; Polymarket says impacted users will be made whole - Product: Polymarket (polymarket.com) ## Affected versions - polymarket.com (international platform) users who connected or signed on Oct 29 2026 ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Specific notes Polymarket has not named the compromised third-party provider. Separately, at 18:00 UTC on Oct 29 web-performance vendor DebugBear posted that it is impacted by an ongoing security incident and told RUM customers to remove its embed code (https://x.com/DebugBear/status/2115866496643535293); X users link it to Polymarket but neither company has confirmed that, so don't state it as the cause. Trading resumed and the status incident was resolved at 19:05 UTC on Oct 29. Many X users now name DebugBear's RUM script as the provider and cite about $2.6M taken; neither is confirmed by Polymarket; CNBC now cites an unnamed source naming DebugBear and Hudson Rock found drainer code in a DebugBear-hosted script. Some traders also dispute the $800K claim (saying funds went to the poster's own other account). Re-check for a named provider, a loss total and refund details; close once quiet. The June 2026 incident (about $3M in pUSD from fewer than 15 accounts via tampered vendor code, refunded) is per BeInCrypto. ## Latest updates - Oct 29, 2026: A Polymarket trader posts that $800,000 was drained from his account, all his positions were sold and a friend lost $600,000, and warns users not to interact with the site. - Oct 29, 2026: Polymarket's status page reports a major outage: the exchange is in cancel-only mode and relayer actions are paused while it investigates an incident. - Oct 29, 2026: Polymarket says one of its third-party providers was compromised, it has identified and fixed the issue on Polymarket.com, referred it to law enforcement, and anyone impacted will be made whole; trading stays halted while the platform is brought back online. - Oct 29, 2026: Polymarket's status page moves to monitoring: a fix is out and trading will resume at approximately 3pm ET. - Oct 29, 2026: Polymarket says trading is fully back online and that it is fully reimbursing all affected traders. - Oct 29, 2026: Polymarket's status page marks the incident resolved. - Oct 29, 2026: The Block reports, citing Arkham data, that a wallet identified as the suspected attacker holds about $2.65M in POL after USDC.e-to-POL swaps through Relay; CoinDesk says DeFi Llama tracks about $2.7M in losses. - Oct 29, 2026: Hudson Rock tells Decrypt a script loaded from DebugBear contains code that looks for a logged-in trading session, sells positions and transfers the assets, with the suspected attacker wallet hard-coded as fallback recipient. ## Advisories - [Polymarket Status: notice history](https://status.polymarket.com/history/1) (Polymarket) ## Write-ups & news - [Polymarket Halts Trading as Users Report $1.4 Million Drained](https://beincrypto.com/polymarket-halts-trading-users-drained/) - [Polymarket restricts trading to cancel-only mode amid wallet drain reports](https://cryptobriefing.com/polymarket-cancel-only-mode-wallet-drain/) - [Polymarket suspends trading after third-party breach leads to user losses](https://www.coindesk.com/markets/2026/10/29/polymarket-suspends-trading-after-third-party-breach-leads-to-user-losses) - [Polymarket pauses trading after $2.65 million exploit, says third-party provider was compromised](https://www.theblock.co/news/defi/2026-10-29-polymarket-exploit-2-5-million-cancel-only-mode-432158) - [Some Polymarket user funds stolen, matter referred to UK authorities](https://www.cnbc.com/2026/10/29/polymarket-reports-outage-on-international-exchange-halts-trading.html) - [Polymarket Pauses Trading as Prediction Market Investigates Security Incident](https://decrypt.co/382185/polymarket-pauses-trading-prediction-market-security-incident) --- Machine-readable: https://pwn.watch/i/polymarket-frontend-third-party-provider-drain-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.