Short answer
On 29 October 2026, malicious code served through a DebugBear monitoring script on Polymarket sold or moved logged-in traders' positions to an attacker's wallet. Polymarket paused trading, said a third-party provider was compromised, and pledged to reimburse affected traders. Loss figures are analyst estimates, not an official total.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Polymarket |
|---|---|
| Incident type | Supply-chain compromise |
| Status | Under investigation |
| Sector | Prediction market and crypto trading |
| Country | United States |
| Detected | 2026-10-29 |
| Disclosed | 2026-10-29 |
| People or records affected | Not published by Polymarket. Analytics firms counted about 710 deposit wallets; losses estimated at $2.2 million to $2.7 million (unverified) |
What data was exposed
- Crypto positions and tokens in affected users' Polymarket accounts
What happened
On Thursday 29 October 2026, malicious JavaScript was served from DebugBear, a UK website performance monitoring company, while running on Polymarket. SecurityWeek reports the code looked for a logged-in user’s trading tools. Depending on the account type, it sold positions and moved the proceeds or sent position tokens to an attacker-set address.
Genfinity adds that the attackers did not break Polymarket’s smart contracts. They compromised a third party whose script already ran in visitors’ browsers. This is a supply-chain attack: the weak link was a vendor, not the platform’s own code.
Timeline
Times below are Eastern, as listed by Genfinity.
- 1:50 to 1:56 PM: attacker wallet activity begins.
- 1:59 PM: a production build removes the DebugBear script.
- 2:05 PM: Polymarket switches to cancel-only mode.
- About an hour later: trading resumes.
How much was lost
Nobody has an official figure. Estimates differ. GoPlus counted roughly $2.71 million across 710 deposit wallets, though addresses do not equal victims. Hudson Rock put about $2.19 million at the script’s fallback address and called that unverified. Arkham linked about $2.65 million to a suspected attacker wallet.
What Polymarket and DebugBear said
Polymarket said a third-party provider was compromised, referred the matter to law enforcement, and promised to make affected traders whole. It did not name the vendor. DebugBear said it was “impacted by an ongoing security incident” and told customers of its real user monitoring product to remove its snippet.
What is still unknown
How DebugBear was compromised, how long the bad code ran, how many users lost money, and whether other DebugBear customers were targeted are all unanswered. SecurityWeek reports there is no indication other DebugBear customers were targeted. Polymarket also disclosed a separate third-party compromise in June, according to SecurityWeek.
Protecting yourself
Incidents like this breed copycat fraud. Learn how phishing messages work, why recovery scams target victims of crypto theft, and how investment scams imitate trading platforms. Our data breach checklist covers general steps, and the breaches index lists other cases.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake reimbursement pages or emails that ask you to connect a wallet or sign a transaction to 'claim' your refund.
- Impersonators on X, Discord and Telegram posing as Polymarket support and asking for seed phrases or wallet approvals.
- Recovery scams offering to trace your funds for an upfront fee.
- Phishing that quotes your real wallet activity to seem credible.
What to do if you are affected
- 01Only accept reimbursement through Polymarket's official channels. Polymarket will not need your seed phrase or private key.
- 02Review your Polymarket wallet history for sales or transfers you did not make, and report them through official support.
- 03Revoke token approvals you do not recognise using a wallet-approvals tool, and avoid signing unexpected requests.
- 04If you run a website, check whether it loads a DebugBear snippet and follow DebugBear's guidance to remove it.
- 05Be sceptical of anyone who contacts you first about the incident, and read our guide to recovery scams.
Frequently asked questions
Was my Polymarket account affected?
Polymarket has not published a list or total. Check your wallet and position history for activity you did not make around 29 October 2026, and contact official support if you find any.
Will Polymarket refund the stolen funds?
Polymarket said it will make all affected traders whole. Per CNBC as cited by Genfinity, users with losses under $10,000 were to be paid by 30 October, while larger losses require a signed release form. Confirm details only on Polymarket's own channels.
Were my passwords or private keys stolen?
Not as far as the sources we read show. SecurityWeek and Genfinity describe the script using an already logged-in session to sell positions or move tokens. Neither says passwords or keys were taken, and Polymarket has not published a full account.
Is Polymarket safe to use now?
Polymarket removed the DebugBear script in a production build and resumed trading about an hour after pausing it. Its investigation is ongoing, and this followed an earlier third-party compromise in June.
Is the Polymarket US platform affected?
Reports say the US platform did not appear to be affected, but Polymarket has not published full details.
Sources
- $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack, SecurityWeek, 2026-10-30
- Polymarket Hack: Compromised DebugBear Script Drains Roughly $2.6 Million From Traders in Minutes, Genfinity, 2026-10-29
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.