Polymarket halts international trading after third-party breach drains user accounts
Affected traders are expected to be refunded, while the platform's US arm was not hit by the intrusion.
Polymarket's flagship international exchange was briefly shut to trading after a breach at a third-party provider, with traders losing funds from their wallets. Wired reports that roughly 700 users were affected and about $2.7 million taken, figures from blockchain analytics firm Bubblemaps, while Polymarket has declined to give its own tally and says it will refund those hit. BleepingComputer traces the intrusion to malicious JavaScript served from infrastructure belonging to DebugBear, a performance-monitoring vendor, which the script used to hijack logged-in trading sessions, sell positions and move assets to an attacker-controlled wallet. Trading was halted from 2:05 p.m. ET and resumed about an hour later, while the wallet linked to the attack moved around 28.6 million POL, worth roughly $2.57 million. Polymarket US, the separately regulated platform for American users, was not affected, and this is the second drain Polymarket has suffered in recent months after a June breach that cost over $2 million.
Why it matters
The breach shows that a user's trading session can be compromised through a supplier's infrastructure, not only through the exchange's own systems. For international users, the incident means losses sit with a vendor breach rather than a direct attack on the platform, and Polymarket has committed to refunding those hit. Polymarket US, the separately regulated platform for American users, was not affected. This is the second drain on the platform in recent months, which puts continued scrutiny on how third-party dependencies are secured.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.