# Polymarket Halts International Trading After Vendor Breach Drains Wallets

- URL: https://usa-24.com/polymarket-hack-vendor-breach-trading-halt/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-30T10:25:10.254Z
- Updated: 2026-10-30T10:25:10.261Z
- Topics: Crypto Security, Prediction Markets, Third-Party Risk, Data Breach, Polymarket

> Polymarket halted trading on its international platform on Oct. 29 after a third-party vendor was compromised and user balances were drained. The company says it will reimburse affected users.

## Key takeaways

- Polymarket halted trading on its international platform, Polymarket.com, on Thursday, Oct. 29, 2026, after one of its third-party providers was compromised.
- Users reported drained wallets around 1:30 p.m. ET, and trading resumed at about 3:00 p.m. ET.
- Outside trackers estimate losses of about $2.65 million to $2.7 million, but Polymarket has not confirmed a total.
- Reuters, citing an unnamed source, reported the vendor was DebugBear, a claim Polymarket has not confirmed by naming the provider.
- Polymarket US did not appear to be affected, and the company has pledged that anyone impacted will be made whole.

Polymarket halted trading on its international platform on Thursday, October 29, after one of its third-party providers was compromised and users reported their balances being drained. The Polymarket hack hit accounts on Polymarket.com, and the company says it will make affected users whole. Trading resumed around 3:00 p.m. ET, but Polymarket has not said how much money is missing or how many people lost it.

## What happened in the Polymarket hack on October 29

Users in the company's Discord reported wallets being drained around 1:30 p.m. ET, while users on X said assets had left their accounts without their approval. Polymarket paused trading, and in a statement on its status page, as [CoinDesk](https://www.coindesk.com/markets/2026/10/29/polymarket-suspends-trading-after-third-party-breach-leads-to-user-losses) quoted it, the company said: “One of our third-party providers was compromised, and we have referred this to relevant law enforcement.”

Trading resumed at about 3:00 p.m. ET. [Tech Insider](https://tech-insider.org/polymarket-resumes-trading-third-party-breach-reimbursement-2026/) reported that the company's status page marked the incident resolved at 3:05 p.m. ET. The [Washington Post](https://www.washingtonpost.com/technology/2026/10/29/polymarket-pauses-international-trading-after-outside-vendors-security-issue/) and [NBC News](https://www.nbcnews.com/business/consumer/polymarket-trading-halt-hack-wallets-rcna606405) both put the halt at roughly one hour.

Polymarket also said it had identified and fixed the issue. In a post on X, as [Yahoo Finance](https://finance.yahoo.com/markets/crypto/articles/polymarket-halts-trading-provider-compromise-221221164.html) quoted it, the company wrote: “Anyone who has been impacted will be made whole.” That pledge is the clearest commitment so far, but reporting has not yet turned up a timeline, a claims process or dollar figures.

## What Polymarket has confirmed and what it has not

Polymarket's own statements cover the halt, the compromise, the referral to law enforcement and the reimbursement pledge. Most of the details that would let users measure their exposure are still missing:

- The vendor's name has not been published.
- The number of affected users has not been disclosed.
- The total dollar loss has not been confirmed.
- The technical path from the vendor to user withdrawals has not been described.
- Reimbursement terms, timing and amounts have not been detailed.

Outside trackers have filled part of that gap. DeFi Llama tracked estimated losses of about $2.7 million. Arkham, a blockchain analytics firm cited by The Block and NBC News, put the amount siphoned at about $2.65 million. The two figures are close, but neither came from Polymarket, and neither should be treated as a final tally.

## Who the vendor is and what reporters know

Reuters, citing an unnamed source, reported that the affected third party was DebugBear, a website performance monitoring platform. The Washington Post reported that its own sources said the same, and that Polymarket reportedly notified U.K. authorities. DebugBear is based in the U.K., which is why that detail links the two reports.

Polymarket has not named the provider, so the DebugBear link rests on anonymous sourcing. Readers should treat it as reported, not confirmed.

Monitoring tools typically run JavaScript on the pages they measure. That places them close to the code that loads in a user's browser, which is why security teams treat such vendors as part of a platform's attack surface, even when they look peripheral.

## Why a second vendor breach raises the stakes

This is not the first time a third party has put Polymarket users at risk. In June, the company disclosed a different vendor breach, as [RG](https://rg.org/news/prediction-markets/polymarket-third-party-provider-breach-user-funds-drained) reported, that injected a malicious script into its frontend for some users and led to a refund pledge. [CoinDesk](https://www.coindesk.com/markets/2026/10/29/polymarket-suspends-trading-after-third-party-breach-leads-to-user-losses) reported that about $3 million was taken from users in that incident.

Yahoo Finance reported that the international service is non-custodial, which means users control their own private keys, and that collateral backing positions sits in smart contracts. That design puts custody with users. It also means a compromise in the software between a user and those contracts can still lead to lost funds, which is the kind of risk the June incident exposed.

Polymarket has not said which path was used this time. That gap matters more than any single loss estimate, because it determines whether other users face the same exposure.

This story is separate from the [Binance theft](https://usa-24.com/binance-hack-crypto-theft-withdrawals/) that USA 24 has already covered, and it should be read on its own terms.

## Is Polymarket US affected

[NBC News](https://www.nbcnews.com/business/consumer/polymarket-trading-halt-hack-wallets-rcna606405) and [Forbes](https://www.forbes.com/sites/conormurray/2026/10/29/polymarket-fully-reimbursing-users-after-halting-international-trading-amid-compromised-third-party-provider/) both reported that Polymarket's U.S. platform did not appear to be affected. Polymarket said the international platform was the one impacted, distinct from Polymarket.us, a separate platform that operates in the United States.

The U.S. business runs through QCX, doing business as Polymarket US. According to the CFTC register cited by Yahoo Finance, the commission designated QCX as a contract market, with the designation dated July 9, 2025. That regulatory separation is one reason U.S. traders are following the incident closely, even though their accounts were not reported as touched.

Whether any users located in the United States used the international platform, and how the CFTC will respond, remain open questions.

## Steps to take if you used the international platform

These are general steps, not instructions from Polymarket.

1. Review your account and wallet activity for withdrawals you did not authorize, starting from around 1:30 p.m. ET on October 29.
2. Revoke any wallet token approvals you do not recognize, using a reputable revocation tool.
3. Type Polymarket.com into your browser or use a saved bookmark before logging in, rather than following links in messages.
4. Treat any unsolicited “reimbursement” message as likely phishing. Reimbursement should come only through official Polymarket channels.
5. Never share a seed phrase or private key with anyone who claims to be support.
6. Save transaction hashes, timestamps and screenshots in case you file a claim or a report.

## What to watch as the investigation continues

Three answers matter most: the vendor's identity, the path from that vendor to user funds, and the reimbursement process. A confirmed name would settle the DebugBear reporting. A technical explanation would show whether the web interface or an integration was the entry point. A published reimbursement timeline would show whether the pledge becomes a process with dates and amounts.

Regulators are the other variable. Any statement from the CFTC would shape how U.S. traders read the company's assurances, and the next update on losses from either Polymarket or outside trackers will show whether the estimates hold.

This incident will test whether Polymarket can make users whole quickly when the breach started outside its own code.

## Frequently asked questions

### Did Polymarket get hacked on October 29, 2026?

Polymarket halted trading on its international platform on October 29, 2026, after one of its third-party providers was compromised. Users reported drained wallets around 1:30 p.m. ET. The company said it referred the matter to law enforcement and will make affected users whole.

### How much money was lost in the Polymarket hack?

Polymarket has not confirmed a total. DeFi Llama tracked about $2.7 million in losses, and Arkham, cited by The Block and NBC News, put the amount siphoned at about $2.65 million. Both figures come from outside trackers, so the final number could change.

### Is Polymarket safe to use after the breach?

Trading resumed around 3:00 p.m. ET, and the status page marked the incident resolved at 3:05 p.m. ET. Polymarket has not publicly described how the vendor compromise led to withdrawals, so the full risk is unclear. Users should check account activity and avoid unsolicited reimbursement messages until the company publishes details.

### Is Polymarket US affected by the hack?

NBC News and Forbes reported that Polymarket US did not appear to be affected. Polymarket said the international platform was the one impacted. Polymarket US operates through QCX, which the CFTC designated as a contract market with a designation dated July 9, 2025.

### Who is the vendor behind the Polymarket breach?

Polymarket has not named the provider. Reuters, citing an unnamed source, reported that the affected third party was DebugBear, a website performance monitoring platform, and Washington Post sources said the same. Those reports rely on anonymous sourcing and have not been confirmed by Polymarket.

## Sources

1. [Polymarket suspends trading after third-party breach leads to user losses — CoinDesk](https://www.coindesk.com/markets/2026/10/29/polymarket-suspends-trading-after-third-party-breach-leads-to-user-losses)
2. [Polymarket pauses international trading after outside vendor's security issue — The Washington Post](https://www.washingtonpost.com/technology/2026/10/29/polymarket-pauses-international-trading-after-outside-vendors-security-issue/)
3. [Polymarket halts trading for an hour after vendor compromise, says affected users will be 'made whole' — NBC News](https://www.nbcnews.com/business/consumer/polymarket-trading-halt-hack-wallets-rcna606405)
4. [Polymarket 'Fully Reimbursing' Users After Halting International Trading Amid 'Compromised' Third-Party Provider — Forbes](https://www.forbes.com/sites/conormurray/2026/10/29/polymarket-fully-reimbursing-users-after-halting-international-trading-amid-compromised-third-party-provider/)
5. [Polymarket halts trading after provider compromise — Yahoo Finance](https://finance.yahoo.com/markets/crypto/articles/polymarket-halts-trading-provider-compromise-221221164.html)
6. [Polymarket Breach: Trading Resumes, 5 Safety Steps [2026] — Tech Insider](https://tech-insider.org/polymarket-resumes-trading-third-party-breach-reimbursement-2026/)
7. [Polymarket Halts Trading After Third-Party Breach Drains User Funds — RG](https://rg.org/news/prediction-markets/polymarket-third-party-provider-breach-user-funds-drained)