# Polymarket (international platform) third-party script exploit: Polymarket halts trading, then resumes, after third-party script compromise drains ~$2.65M from users
Source page: https://vaultx.llc/hacks/polymarket-exploit-october-2026 · VaultX incident report by Sentinel · first published 2026-10-30, updated 2026-10-30
- Date: 2026-10-29
- Reported loss: $2.6M (Most widely reported figure is about $2.65M (NBC/The Block/Unchained per research notes). Other outlets say 'more than $2.5M' or about $2.7M across 700+ accounts (FinanceFeeds); Polymarket's own total was not given in the research.)
- Attribution: Unknown. Polymarket blamed a compromised third-party provider and, per the research, did not name a human attacker or group. Some media name DebugBear as the suspected provider, reportedly based on unnamed sources and security analysis, not independently confirmed.
- Chains: Polygon (reportedly)
- Status: contained
- Severity: 36/100
- Response score: 76/100 (Trading was halted fast and resumed the same day, a full-reimbursement pledge was made and law enforcement was notified; held back by no named vendor or attacker, and a release form for larger losses.)
On 2026-10-29 Polymarket paused trading on its international platform after users reported drained balances. The company said a third-party provider had been compromised. Security analysis points to malicious JavaScript that hijacked logged-in user sessions, not a smart-contract flaw. Reported losses are about $2.65M, and Polymarket resumed trading the same day and promised to make affected users whole.

**What happened**
On October 29, 2026, users of Polymarket's international platform posted on X that their balances had been drained without authorization. CoinDesk reportedly confirmed that some users saw balances drained. Polymarket paused trading, reportedly moving to cancel-only mode, while it investigated.
Polymarket said a third-party provider had been compromised and that it had fixed the issue on its end. It reopened trading around 3 p.m. ET the same day, according to coverage cited in the research. It also said it referred the matter to law enforcement. CNBC reportedly said the referral was to U.K. authorities.
Reported losses are about $2.65M. Some outlets say more than $2.5M, and FinanceFeeds says about $2.7M from more than 700 accounts, a figure the research treats as approximate. The Wall Street Journal reportedly said the funds moved in more than 900 transactions.
On reimbursement, Polymarket said affected users would be 'made whole'. CNBC reportedly said users who lost under $10,000 would be restored by Oct. 30, while larger losses would require a release form.

**How it worked**
Per Security Boulevard's technical analysis and BleepingComputer, malicious JavaScript was served through a third-party vendor script on Polymarket's site. Some coverage names a monitoring provider, DebugBear, as the suspected source, reportedly without independent confirmation. The code appears to have targeted authenticated trading sessions rather than Polymarket's core smart contracts. It is described as a front-end or supply-chain compromise.
Once a user's session was active, the script reportedly could read balances and act through Polymarket's normal trading and withdrawal paths. The analysis describes several routes: building signed transaction batches through Polymarket's relayer, approving and swapping collateral, selling positions at aggressive prices and withdrawing the proceeds, or moving outcome-token balances from the user's deposit wallet to the attacker with ERC-1155 batch transfers. Reporting says the attacker address was hard-coded as a fallback recipient in the malicious script.

**Where the money went**
Per reporting by Hudson Rock, Arkham-traced coverage and BleepingComputer, the drained USDC.e/USDC was swapped into roughly $2.57M-$2.65M of POL through Relay. BleepingComputer reportedly said the wallet then moved about 28.6M POL (about $2.57M) into three additional wallets. The research found no documented use of mixers, bridges or exchange deposits beyond the Relay swaps and the follow-on wallets. No verified report of an on-chain freeze or official recovery of attacker funds was found.

**The response**
Polymarket paused trading quickly, said a third-party provider was compromised, and reopened the same day after fixing its side. It said it referred the matter to law enforcement and pledged to make affected users whole. Per CNBC, losses under $10,000 would be restored by Oct. 30, and larger ones need a release form. The company did not name the vendor or an attacker in its statement, and the research does not show a regulator action.

**Impact**
Trading on the international platform was briefly halted, and the research shows no clear sustained price shock across Polymarket markets. Users reported unauthorized drains, with about 700+ accounts reportedly affected (approximate). The reimbursement pledge reportedly eased some of the immediate panic.

**Wallets linked to this case**
- 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18 (Polygon (reportedly), attacker (suspected; most-cited drain and swap wallet, repor) source: https://www.ababnews.com/en/news/0b6e9769-cac5-4fc4-acab-aa425d4c9d84

**Timeline**
- 2026-10-29 Users report drained balances on X; Polymarket suspends trading on its international platform (reportedly cancel-only mode).
- 2026-10-29 Polymarket says a third-party provider was compromised and that it fixed the issue on its end. CoinDesk reportedly confirms some users' balances were drained.
- 2026-10-29 Trading resumes around 3 p.m. ET (per reports). Polymarket says affected users will be made whole and that it has referred the matter to law enforcement.
- 2026-10-29 Security analysis published describing the malicious JavaScript session-hijack; BleepingComputer reports on-chain tracing of the funds.
- 2026-10-30 Per CNBC, users with losses under $10,000 are due to be restored by this date; larger losses require a release form. FinanceFeeds reports about $2.7M lost across 700+ accounts.

**How to protect yourself**
- Users: treat any site that loads third-party scripts as a risk. Use a separate wallet with limited funds for trading, and review and revoke token approvals regularly.
- Users: if you see unexpected transactions, stop trading and check on-chain activity. Be careful with any release form and confirm it comes from official channels.
- Builders: vendor and monitoring scripts running in authenticated sessions are a high-value target. Use Subresource Integrity, a strict Content Security Policy, and script isolation or sandboxing on pages that handle signing or withdrawals.
- Builders: add withdrawal safeguards such as allowlisted addresses, anomaly detection and delays on large or unusual transfers, so a hijacked session cannot drain funds quickly.

**Still unknown**
- Whether DebugBear was the compromised provider; this is reported but not independently confirmed.
- Who is behind the attack, and how the vendor was compromised.
- The exact total loss and number of affected accounts, which differ across outlets ($2.5M-$2.7M; 700+ accounts).
- The full list of affected assets and chains.
- Whether any attacker funds have been frozen or recovered.
- Final reimbursement completion and the terms of the release form for larger losses.

**Sources**
- NBC News - Polymarket trading halt, hack, wallets https://www.nbcnews.com/business/consumer/polymarket-trading-halt-hack-wallets-rcna606405
- CoinDesk - Polymarket suspends trading after third-party breach leads to user losses https://www.coindesk.com/markets/2026/10/29/polymarket-suspends-trading-after-third-party-breach-leads-to-user-losses
- BleepingComputer - Polymarket halts trading after crypto-draining script breach https://www.bleepingcomputer.com/news/security/polymarket-halts-trading-after-crypto-draining-script-breach-25m-traced/
- CNBC - Polymarket reports outage on international exchange, halts trading https://www.cnbc.com/2026/10/29/polymarket-reports-outage-on-international-exchange-halts-trading.html
- Wall Street Journal - Polymarket pauses trading after some users report funds drained https://www.wsj.com/business/polymarket-pauses-trading-after-some-users-report-funds-drained-b014527d
- Bloomberg - Polymarket halts trading after reports of customers losing money https://www.bloomberg.com/news/articles/2026-10-29/polymarket-halts-trading-after-reports-of-customers-losing-money
- The Block - Polymarket exploit, cancel-only mode https://www.theblock.co/news/defi/2026-10-29-polymarket-exploit-2-5-million-cancel-only-mode-432158
- Unchained - Polymarket resumes trading, vows to reimburse traders https://unchainedcrypto.com/polymarket-resumes-trading-vows-to-reimburse-traders-after-third-party-provider-compromise/
- Security Boulevard - Dissecting the Polymarket malicious JavaScript exploit https://securityboulevard.com/2026/10/dissecting-the-polymarket-malicious-javascript-exploit-compromise-an-analysis/
- FinanceFeeds - Polymarket restores trading after hack drains est. $2.7M from 700+ accounts https://financefeeds.com/polymarket-restores-trading-after-hack-drains-an-estimated-2-7-million-from-more-than-700-accounts/
- Ababnews - wallet and fund-flow reporting https://www.ababnews.com/en/news/0b6e9769-cac5-4fc4-acab-aa425d4c9d84
- Crypto Economy - Polymarket restores trading after $2.65M exploit https://crypto-economy.com/polymarket-restores-trading-after-2-65m-exploit-linked-to-compromised-third-party-provider/
- Washington Examiner - Polymarket UK platform, DebugBear hacked https://www.washingtonexaminer.com/policy/technology/4785092/polymarket-uk-platform-debugbear-hacked-trading-security-incident/
- BNO News: Some Polymarket users report losing funds after security breach https://bnonews.com/index.php/2026/10/some-polymarket-users-report-losing-funds-after-security-breach/
- FinanceFeeds: Polymarket restores trading after $2.65M drain https://financefeeds.com/polymarket-restores-trading-after-2-65m-drain-promises-full-reimbursement/
- Bitcoin.com News: Polymarket halts trading, exploit stole estimated $2.7M https://news.bitcoin.com/security/polymarket-halts-trading-exploit-stole-estimated-2-7m-users/

---
VaultX: free crypto news and intelligence, https://vaultx.llc