Polymarket halts trading after third-party hack drains user wallets days before midterms

Polymarket, the prediction-markets platform that processes roughly $200 million in trades daily, was forced to suspend trading on its international exchange for nearly an hour on Thursday after hackers exploited a compromised third-party software provider to drain funds from user wallets — an attack timed, whether deliberately or not, just days before the U.S. midterm elections on November 3.

The company identified the breach, fixed the issue, and brought its international platform, Polymarket.com, back online at 3 p.m. ET. Its U.S.-based platform was not affected. Polymarket said it had referred the matter to British law enforcement authorities, and pledged to reimburse every affected trader.

We'll make this right and are fully reimbursing all affected traders.— Polymarket, via X post

The attack traced back to DebugBear, a UK-based web analytics and website performance monitoring tool used by Polymarket, according to people familiar with the matter who spoke to both NBC News and CNBC. DebugBear acknowledged on X that it was experiencing an 'ongoing security incident' at around 2 p.m. ET Thursday. DebugBear did not immediately respond to requests for comment.

The scale of the theft is still being established. Blockchain analysis group Arkham, cited by crypto news site The Block, put the figure at approximately $2.65 million. A separate analysis of publicly available data by two analytics firms — Betting Intelligence and Polysights — provided to CNBC found that a single account withdrew at least $2.7 million across 710 wallets. Polymarket declined to confirm either figure or to describe the precise mechanics of the attack.

This is certainly a significant and new form of breach that we've seen on Polymarket. The timing right before the midterms ...is certainly a wake up call for folks.— Dan Zimmermann, Chief Intelligence Officer, Betting Intelligence

Users first flagged the problem themselves, reporting unauthorized withdrawals on social media and in Polymarket's Discord channel. The company responded by halting trading and later told users in Discord that those who lost less than $10,000 would have funds restored by October 30; those with larger amounts taken would need to sign a release form before receiving reimbursement.

Thursday's incident is not the first time Polymarket has been hit through a vendor. In June, the company said a third-party provider had been 'compromised' and pledged to refund affected users in what appears to be a near-identical pattern of attack, according to CNBC. Compromising third-party vendors has become a common method for attackers to reach large platforms without breaching their core systems directly.

Polymarket's international exchange operates as a decentralized finance platform on the Polygon blockchain and is not regulated in the U.S. The platform was valued at $21 billion in September after a group of investors led by Donald Trump Jr. invested $1 billion in the company, according to NBC News.

The breach lands at a fraught moment for the prediction-markets industry more broadly. Polymarket and rival Kalshi are already at the center of an ongoing regulatory fight between U.S. states and the Trump administration over jurisdiction. Both platforms are also contending with insider-trading concerns: earlier Thursday, Bloomberg News reported Polymarket was investigating suspicious bets placed around Israel's elections, and the company's head of global intelligence and investigations, Shana Bautista, said it is also examining 'dozens' of bets related to the U.S. midterms. Kalshi separately said earlier this month it was looking into suspicious bets tied to Trump's choice for press secretary.

With midterm election trading expected to drive the highest volumes of the year on both Polymarket's international and U.S. exchanges, Thursday's outage underscores the exposure that comes with relying on external software vendors — and the pressure on the platform to restore user confidence before November 3.

Why it matters — A second successful third-party hack in four months drained millions from users of a $21 billion platform days before its highest-stakes trading event of the year, raising questions about the security of vendor dependencies in decentralized finance.

Reported by nbcnews.com, cnbc.com, coindesk.com