Polymarket Temporarily Froze Trading After Hackers Reportedly Stole Millions Via Third-Party Service

Hackers broke into gambling “prediction market” site Polymarket’s international exchange and stole an undisclosed amount of user funds, CNBC reported on Thursday, with one source telling the network that the incident originated with UK-based web performance monitoring firm and Polymarket vendor DebugBear. The incident affects Polymarket, the international crypto-based site, and not Polymarket US, the federally regulated exchange that like competitor Kalshi has been accused of violating state gambling laws across the country, according to Wired. Polymarket and Kalshi have also been accused of enabling rampant insider trading, ranging from run-of-the-mill profiteering on inside corporate info to presidential pardons and military strikes. Throughout Thursday afternoon, some traders reported seeing unauthorized withdrawals from their accounts. Polymarket wrote on X that the exchange had been switched to “cancel-only mode” just after 2:00 p.m. ET, shortly after DebugBear tweeted that an “ongoing security incident” had compromised its Real User Monitoring (RUM) service. In a thread, Polymarket said “one of our third party vendors was compromised.” DebugBear’s website remained inaccessible as of early Thursday evening. We're impacted by an ongoing security incident. If you use our RUM product, please remove the embed code from your website. — DebugBear (@DebugBear) October 29, 2026 Polymarket announced that the issue was resolved as of 3:00 p.m. ET, and that it had reported the incident to police, CNBC reported. According to crypto news site The Block, data from analytics platform Arkham showed that a suspected attacker stole approximately $2.65 million in tokens. Security incidents at Polymarket since last year have included an attempt to hijack the resolution of a bet concerning Ukraine’s mineral rights, a $3.1 million phishing spree, and “suspicious outflows” that revealed a $520,000 theft exploiting contract infrastructure. As Wired noted, Polymarket recently raised $1 billion in a fundraising round led by 1789 Capital, where Donald Trump Jr. is a partner. Trump Jr. is also an advisor at Kalshi. Sites of Polymarket’s and Kalshi’s ilk have largely relied on cozy relationships with Republicans and the White House to win regulatory approval by the federal Commodity Futures Trading Commission (CFTC), but CNBC separately reported Democrats in Congress may take a tougher approach if they take control of the House and/or Senate in next week’s midterm elections. (At a minimum, they appear thirsty to investigate Trump Jr.’s involvement with Polymarket and whether that led to the CFTC not only taking a laissez-faire approach to prediction markets, but launching a series of lawsuits arguing states can’t regulate them either.) Polymarket has said it will reimburse all customers affected by the incident. Polymarket didn’t immediately respond to Gizmodo’s request for comment on this story, and attempts to contact DebugBear via email bounced with DNS error messages. We’ll update if we hear back.