Reporting checked October 30, 2026, at 8:10 a.m. ET. Educational analysis, not financial advice.

The Polymarket security breach briefly halted trading on the platform's international exchange after a third-party provider was compromised. Polymarket said trading returned at 3:00 p.m. ET on October 29 and promised to reimburse every affected trader. Users still need to verify account activity and reimbursement terms. Platform-specific access should also be checked before placing new orders.

TL;DR

  • Polymarket halted trading on its international platform for nearly an hour after identifying a compromised third-party provider.
  • The company said the issue was fixed and trading was fully restored. It also said affected traders would be reimbursed.
  • CNBC reported an estimated $2.7 million withdrawn across 710 wallets. Polymarket has not confirmed that figure as a final loss.
  • CNBC and NBC News reported that the U.S. platform was not affected. The incident centered on Polymarket.com.
  • Traders should separate a restored trading screen from confirmed account recovery. Reliable withdrawals and a complete incident explanation are separate checks.

What happened during the Polymarket security breach?

Polymarket said in its first public incident update that it had identified and fixed an issue affecting Polymarket.com. The company attributed the problem to a compromised third-party provider and referred the matter to law enforcement. It temporarily stopped trading as a precaution.

In a later platform update, Polymarket said trading was fully back online and that it would reimburse all affected traders. Reuters independently reported the restoration and reimbursement pledge.

NBC News reported that the international platform was offline for nearly an hour and resumed at 3:00 p.m. ET. NBC also said Polymarket's U.S. platform did not appear to be affected. That distinction matters because the international and U.S. services have different operating structures and access rules.

The provider was not named in Polymarket's public statement. NBC and CNBC reported, citing people familiar with the event, that the issue involved DebugBear, a web performance monitoring service. DebugBear separately acknowledged an ongoing security incident and told users of its real-user-monitoring product to remove its embed code.

What is confirmed, and what remains an estimate?

The strongest confirmed facts are the international trading halt and Polymarket's third-party provider explanation. The company also confirmed a law-enforcement referral. It restored trading and promised reimbursement. Those points appear in the company's own updates and in independent reporting.

The size of the loss is less certain. CNBC said two analytics firms reviewed public data and estimated that one account withdrew at least $2.7 million across 710 wallets. NBC cited The Block's report of roughly $2.65 million using Arkham data. Polymarket declined to confirm that figure to NBC.

These estimates may describe observable wallet movements without establishing the platform's final reimbursable loss. A complete accounting would need to identify affected accounts and distinguish unauthorized transfers from legitimate activity. It would also need to reconcile any recovered funds. Until Polymarket publishes that work, traders should treat $2.65 million to $2.7 million as an outside estimate rather than a company-confirmed total.

Why the outage matters to prediction-market traders

A prediction-market position depends on more than the contract's implied probability. Order-book access and the ability to cancel an order can change the risk of holding the same contract. Reliable custody is another variable. A trader who cannot manage an open order during a halt faces a different risk than someone analyzing the event outcome alone.

The incident arrived days before the November 3 U.S. midterm elections, when news-sensitive contracts may draw heavier activity. More traffic can widen the cost of an outage because prices can move while users cannot adjust orders. It can also attract impersonation attempts that target people waiting for account updates.

For traders who compare venues, this is also a market-structure issue. Contract prices on two platforms are not interchangeable when account access, custody, or recovery procedures differ. ChartDojo's guide to prediction-market liquidity and slippage explains why executable prices matter more than the displayed midpoint. Its prediction-market resolution-risk checklist applies the same verification discipline to contract terms.

A five-check incident response worksheet

This worksheet adds a decision process to the breaking news. Complete each check before treating restored trading as a return to normal:

  1. Scope: Confirm which Polymarket service and account you use. The reports distinguish the international platform from the U.S. platform.
  2. Account record: Save your balance history and open positions. Keep withdrawal records with their transaction identifiers. Record the time of any activity you do not recognize.
  3. Recovery channel: Use only official platform notices and support routes. Do not act on direct messages that ask for a wallet signature, seed phrase, or payment to release funds.
  4. Reimbursement status: Separate Polymarket's broad promise from your own documented claim status. CNBC reported different handling for accounts below and above a $10,000 loss threshold.
  5. Execution test: Before returning to normal size, verify that order entry and cancellation work as expected. Check withdrawal access separately. A small operational check can reveal restrictions that a home-page notice does not show.

The worksheet does not prove that an account is safe. It creates a record of what the trader verified and what still depends on Polymarket's investigation.

Potential positives vs negatives

Potential positives

  • Polymarket identified the issue quickly enough to pause trading and said it had fixed the affected path.
  • Trading returned within roughly an hour, limiting the duration of the market-access interruption.
  • The company promised full reimbursement and referred the matter to law enforcement.
  • Independent reporting indicates the U.S. platform was not part of the incident.

Potential negatives

  • The provider compromise reportedly led to unauthorized withdrawals from user accounts.
  • Polymarket has not published a final affected-account count or a confirmed loss total.
  • Reimbursement can take time, especially for larger claims that require additional documentation.
  • A second reported vendor incident in the same year would raise questions about third-party software controls.

What could happen from here

Base case

Polymarket processes reimbursements and keeps trading online. It also publishes a clearer account of the provider failure. Completed repayments and stable withdrawals would confirm this path. Delays or unexplained new account activity would weaken it.

Upside case

The platform verifies that the incident was tightly contained and repays all affected traders. New vendor controls prevent a repeat during the midterm volume surge. Public technical findings and a clean period of high-volume operation would support this case. Another vendor-linked interruption would invalidate it.

Downside case

The affected-account count rises, reimbursement disputes persist, or investigators find that the compromise reached more systems than first stated. New unauthorized transfers or renewed trading restrictions would support this case. A complete reconciliation and verified recovery would reduce the risk.

What traders should watch next

  • Polymarket's final explanation of the compromised provider and the affected software path.
  • A confirmed loss total and affected-account count, followed by a reimbursement completion report.
  • Whether withdrawals and order cancellations remain reliable during midterm-related volume.
  • Any law-enforcement statement or disclosure from DebugBear about the incident scope.
  • Changes to third-party scripts, account security controls, or user notification procedures.

FAQ

Was the Polymarket U.S. platform breached?

CNBC reported that the U.S. platform was not compromised, and NBC said it did not appear to be affected. The confirmed halt involved Polymarket's international platform.

How much was taken in the Polymarket breach?

Independent analytics cited by CNBC estimated at least $2.7 million across 710 wallets. NBC cited a separate estimate near $2.65 million. Polymarket has not confirmed a final total.

Has Polymarket resumed trading?

Yes. Polymarket said trading was fully back online, and independent reports placed the restart at about 3:00 p.m. ET on October 29. Users should still verify their own account status and withdrawal access.

Will affected users be reimbursed?

Polymarket said it would fully reimburse affected traders. CNBC reported that smaller claims were expected to be restored by October 30, while larger claims could require a release form. Users should confirm the current procedure through official support.

Sources

Feature image: Polymarket wordmark via Wikimedia Commons. Public-domain text logo; trademark rights may apply.

Build real skills, not bad habits. Use ChartDojo's AI-powered feedback to review fast-market decisions and start a free trial.