Polymarket Reopens Trading, Pledges to Repay Traders After Provider Compromise
Polymarket reopened its international platform around 3 p.m. ET Thursday, confirmed a third-party provider was compromised and referred to law enforcement, and pledged to repay affected traders. Outside loss estimates range from $2.19 million to $2.65 million.
Polymarket reopened trading on its international platform at about 3 p.m. ET on Thursday and said it will repay every trader who lost money after one of its third-party providers was compromised. The company has not disclosed the size of the loss, the number of accounts affected, or the provider's name.
The exchange had gone into cancel-only mode earlier in the day, as reported in our earlier coverage. Its status page marked the incident resolved at 3:05 p.m. ET.
At 2:33 p.m. ET, Polymarket said it had fixed an issue affecting the international platform and confirmed the cause.
"One of our third party providers was compromised, and we have referred this to relevant law enforcement."
Polymarket
The company added that "Anyone who has been impacted will be made whole." A later post on X from @PolymarketTrade said trading was back online and affected traders are being reimbursed.
Outside estimates of the damage vary. Arkham data showed the suspected attacker wallet holding about $2.65 million in POL. Hudson Rock counted roughly $2.19 million at a fallback address and called its figure unverified. The wallet, 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18, received multiple USDC.e-to-POL swaps via Relay and later moved funds to other addresses.
Hudson Rock, in an analysis published on infostealers.com, said a script served from DebugBear's servers was built to find users signed in to Polymarket, check their holdings and try to sell or transfer assets. The same wallet is hard-coded in the script as a fallback recipient. Polymarket's production site code records the script's removal. Hudson Rock has not established how the compromise began or how many users were hit.
DebugBear is a U.K.-based analytics company. According to a news report, it knew of an ongoing security incident and told customers of its RUM (real user monitoring) product to remove its embed code. Polymarket has not said whether DebugBear is the provider in question.
Third incident since May
The episode follows two earlier incidents this year. In May, a compromised private key drained about $700,000 from an internal wallet. In June, a vendor compromise let attackers inject frontend code, and about $3 million was drained from fewer than 15 users, per a Bubblemaps estimate. Polymarket pledged reimbursement then as well.
All three incidents were reported through access points around the platform, not through a flaw in its trading contracts.
