Wallet Linked to Suspected Attacker Holds $2.65 Million in POL After Polymarket Breach
Key Facts
Polymarket temporarily halted trading on its international platform, Polymarket.com, after one of its third-party providers was breached, and referred the incident to law enforcement, according to a company update on its status page. The company did not disclose total losses or the number of traders affected. The Block, citing Arkham data, estimated that a wallet linked to a suspected attacker held about $2.65 million in POL. That is an estimate of a wallet’s contents, not an official disclosure of stolen funds or a final tally for the incident. The company said the issue affecting its international platform had been identified and fixed.
The status page update showed that the prediction-trading interface had entered “cancel-only” mode, allowing users to cancel orders without processing new orders or trades. The company also suspended relayer operations during the investigation, The Block reported, citing the status notice. The recorded disruption was limited to the prediction-trading interface, while the Polymarket website and account-access and authentication services were listed as operational. The measure therefore did not amount to a suspension of all platform services or indicate that all operations were down. The status page said new trades and orders were not being processed during the restriction.
The status page recorded the start of the investigation and cancel-only mode at 18:05 UTC on October 29, 2026, then logged the issue as identified and fixed at 18:37 UTC. The Associated Press said trading stopped for about an hour and resumed Thursday afternoon. Polymarket said affected traders would be fully compensated, stating: “Everyone affected will be fully compensated.” The company also said it had referred the incident to law enforcement, while the news agency reported that the referral included a UK law enforcement agency. The available updates did not disclose total compensation or when it would be paid.
Polymarket did not name the third-party service provider in its official update. The Associated Press reported that accounts linked the incident to UK-based DebugBear, which provides website-performance monitoring tools, but the platform operator did not make that connection. The agency said DebugBear’s website was unavailable Thursday afternoon and that the company said on X that it was affected by an ongoing security incident. It added that it had advised customers using one of its products to remove the embed code from their websites. DebugBear did not immediately respond to the agency’s request for comment. The reported link alone does not establish that the incident originated with a particular product or identify how the breach occurred.
The incident comes as prediction platforms have gained a growing presence, with their contracts allowing trading on election, sports, financial and geopolitical outcomes, Reuters reported. The agency said interest in the platforms grew during the 2024 U.S. presidential election. EL7’s archive includes an earlier story published on June 26, 2026, about a $2.9 million theft from Polymarket and its pledge to compensate users. That story concerned a previous incident, and the available information does not show whether its mechanism was connected to the current incident. In the latest development, Polymarket said it had fixed the issue and resumed trading, and pledged to compensate affected users, while total losses remained undisclosed.