Hackers stole approximately $2.7 million from more than 700 accounts on Polymarket’s international exchange on October 29, 2026. The attack forced the prediction market platform to pause trading while it addressed the problem. Polymarket says it will repay affected customers, and its separate U.S. platform was not compromised.
The incident raises an important question: How can users lose money when a platform’s core blockchain technology has not been shown to fail? In this case, investigators pointed to outside software that operated within users’ browsers.
The news comes on the heels of the announcement that the prediction markets platform will stop offering sports contract in Michigan.
How the Attack Worked
Security researchers linked the attack to malicious code delivered through DebugBear, a service that monitors website performance. Instead of simply measuring how a website worked, the altered script searched for people who were already logged into Polymarket. It then used those active sessions to access trading functions.
The attackers could sell positions and transfer assets using permissions already available through those sessions. Researchers did not find a separate function in the examined code that sent passwords, private keys, or wallet recovery phrases to the attackers. Instead, the attack misused access that logged-in users already had.
That distinction matters. The blockchain could process transactions with valid authorization even though the actual account owners had not approved the theft. The reported weakness involved website software and session access, rather than an identified flaw in the underlying smart contracts.
How Much Money Was Lost?
Blockchain analytics firm Bitquery traced about $2.73 million in unauthorized withdrawals across 737 accounts. Another analysis cited by CNBC identified approximately 710 affected wallets. Those estimates differ, but both indicate that more than 700 accounts were involved.
Polymarket temporarily restricted trading while responding to the breach. Operations later resumed after the company said it had fixed the issue on its end. The company also referred the incident to law enforcement, with reporting identifying authorities in the United Kingdom, where DebugBear is based.
NBA superstar LeBron James recently partnered with Polymarket and the platform became the official prediction market of the Association of Tennis Professionals (ATP).
How Reimbursement Is Being Handled
Polymarket’s reimbursement plan goes beyond replacing stolen funds. The company said it would return $3.9 million altogether: $2.7 million for the theft and another $1.2 million to cover losses connected to the trading pause. These figures should not be combined into a larger estimate of stolen money.
According to CNBC’s October 30 update, Polymarket reported that it had refunded 95% of affected wallets. That figure describes wallets, not necessarily 95% of the total money owed.
The company also told users through Discord that customers who lost less than $10,000 would have their funds restored by October 30. Customers with losses greater than $10,000 would need to sign a release form before receiving repayment. The reporting did not explain how losses of exactly $10,000 would be treated or provide the release form’s terms.
What Remains Unclear
The reported progress is substantial, but it is not proof that every claim has been settled.
A final accounting and clearer information about outstanding repayments would help establish whether all affected customers have been fully compensated. Investigators also had not resolved how the outside provider was initially compromised.
