Polymarket: A Hacked Website Tool Drained $2.65M From Hundreds of Traders in an Hour
A hacked monitoring script on Polymarket's real website drained about $2.65M from hundreds of traders on 29 October. Polymarket says it will repay them all.
Key numbers
$2.65M
Drained
710 to 995 (estimates)
Accounts hit
Full, pledged by Polymarket
Refund
Unidentified
Attacker
On the afternoon of Thursday 29 October 2026, people trading on Polymarket.com watched their bets being sold and their money leaving, without touching a button. They had not clicked a fake link or typed a password into a copycat site. They were on Polymarket's real website. The website itself was robbing them.
Polymarket is the world's best known prediction market: people buy shares in the answer to a question, such as who will win an election, and a correct share pays $1. It handles roughly $200 million of trading a day, NBC News reported. Its international site, Polymarket.com, runs on Polygon, a blockchain (a shared public ledger that records every payment), and bets are made in digital dollars.
How much, and from how many
Polymarket has not said how much was taken or how many people lost money. Outside counts agree on the size and disagree on the headcount. Conor Grogan, a blockchain analyst, counted 995 drained accounts and a total of $2,654,211.42, U.Today reported, with the two biggest single losses at $341,000 and $307,000. Arkham Intelligence, a blockchain tracking firm, showed the suspected thief's wallet holding about $2.65 million, according to The Block and Decrypt. Betting Intelligence and Polysights, two analytics firms, told CNBC that at least $2.7 million went out across 710 wallets. Bubblemaps, another tracking firm, put it at about $2.7 million from roughly 700 users, according to WIRED.
The early reports ran lower. One headline that afternoon put the damage at $1.4 million while the drain was still going. Most outlets settled on $2.6 million to $2.7 million. CMZ counts the $2.65 million found in the thief's wallet.
A trusted tool turned thief
Websites load small pieces of code from outside companies all the time, for adverts, chat boxes and speed measurement. It is like a shop letting a contractor's staff work behind the counter: they are trusted because the shop trusts the contractor. Polymarket's site loaded a script from DebugBear, a British company that measures how fast web pages load for real visitors.
On 29 October that script stopped measuring and started stealing. A person familiar with the matter told CNBC that the hack came through DebugBear. Polymarket has not named the company; it said only that "one of our 3rd party providers was compromised". DebugBear posted on X that it had been "impacted by an ongoing security incident" and told customers to remove its code from their sites.
Hudson Rock, a cyber-crime research firm, downloaded the poisoned file from DebugBear's servers twice at 18:12 and 18:13 UTC and took it apart. It did not need anyone's password or secret key. It waited for a trader who was already signed in, found the part of the page that places orders, and used the trader's own live session to give instructions. In stock-market terms, it is as if someone sat down at a broker's terminal that a client had left logged in and started entering trades.
The script first checked the visitor's account and holdings, skipping portfolios below a set minimum. Then it emptied them in one of two ways. For traders who connected their own crypto wallet, it moved their bet shares straight to the thief. For traders who signed up with an email address, it sold their bets at falling prices, first at about 97% of the market price, then at half, then at almost nothing, and tried to send the cash on. Grogan said the thief swapped everything into POL, Polygon's own coin, probably so that the digital dollars could not be frozen by their issuer.
The script also asked Polymarket's own systems whether the visitor was in a blocked country and left those visitors alone. People in the United States, for example, are not supposed to use Polymarket.com. Americans use Polymarket US, a separate app regulated by the Commodity Futures Trading Commission, which was not affected, CNBC reported. That is why the trending headlines spoke of international users: the victims were customers of the international site.
The hour it took
Times are UTC. StarPlatinum, an on-chain investigator quoted by U.Today, said an empty wallet started receiving money at about 17:05. By about 17:25 it held some $412,000, by 17:50 about $2.02 million, and by 18:05 about $2.68 million.
Polymarket's site code shows a build at 17:59 with the note "remove debugbear rum script", Hudson Rock found; that is when the change was built, not proof of when the script stopped loading. DebugBear's warning went out at about 18:00. At 18:05 Polymarket put its exchange into "cancel-only" mode, so traders could pull orders but not place new ones. At 18:33 it said it had "identified & fixed an issue impacting our international platform" and had referred the matter to law enforcement. Trading was "fully back online" at about 19:00, and the status page marked the incident resolved at 19:05. Between 18:28 and 18:38 the thief's wallet sent out about 28.6 million POL in three transfers, according to Polygonscan records cited by RG.org.
Not the first time
This is Polymarket's third security incident since May 2026. In May a leaked private key, the password that controls a crypto wallet, let someone drain about $700,000 from an internal wallet used for user rewards, Decrypt reported. On 25 June Polymarket said a compromised outside vendor had let attackers plant malicious code on its website; Bubblemaps estimated about $3 million taken from fewer than 15 accounts, and Polymarket said it was refunding them in full. It never named that vendor either.
The October attack had the same shape and a much wider reach. In June a handful of large accounts were hit. In October the script went after nearly everyone signed in with more than a few dollars.
The trick is also older than Polymarket. In February 2025 the exchange Bybit lost about $1.5 billion after software it relied on, supplied by an outside firm, was tampered with so that staff approved one transfer and signed another. The lesson both times: a company is only as safe as the least protected firm whose code runs on its screens.
The aftermath
As of 30 October 2026, Polymarket has promised to repay every affected trader from its own funds but has not said how much it will pay, to how many people, or when. It has not published a loss figure, a count of victims or the name of the provider, and says a technical report will follow once the investigation ends. It said the attack appeared to come from the United Kingdom, where DebugBear is based, and referred it to British police. DebugBear's script and data addresses stopped working later that evening, and the company has not said how it was breached or whether its other customers were served the same code.
The thief has not been identified. The money sat in POL, Polygon's coin, and was being moved on. Polymarket US, the separate American app, was not affected. The case is counted at the $2.65 million taken, under CMZ's rule that money later refunded does not lower a hack's figure.
What this teaches
- The real website can be the danger. Traders did nothing wrong: the attack ran inside Polymarket.com through code supplied by another company.
- Every outside script a site loads can act with the visitor's full permissions. A speed-measuring tool had the same reach as the site itself.
- A signed-in session is as good as a password. The script never needed keys or passwords because it used sessions traders had already opened.
- Refund promises are not refunds. Polymarket pledged to repay in full but, a day later, had not given a total, a list or a date.
- The same weakness hit Polymarket in June. A second vendor attack in four months points to how its site trusts outside code, not to bad luck.
COMMENTS