Polymarket Halts Trading After $2.6 Million User Fund Drain

Polymarket temporarily suspended operations on its international platform after a third-party engineering flaw led to hackers draining at least $2.6 million from user accounts. The incident, attributed to a compromised web monitoring script, saw funds rapidly moved from active balances, prompting Polymarket to enter a ‘cancel-only’ mode and pause its relayer infrastructure.

What Happened

Prediction market platform Polymarket temporarily suspended its international exchange operations after hackers exploited a third-party engineering flaw to drain at least $2.6 million from user accounts. The incident, which occurred on Thursday, involved unauthorised withdrawals and sudden balance liquidations reported by traders on the exchange (Business Today).

The breach was linked to a compromised web monitoring script provided by DebugBear, a UK-based third-party developer, according to blockchain records and security research firm Hudson Rock. Attackers embedded unauthorised code into Polymarket’s frontend, enabling them to scrape active user trading sessions, liquidate open holdings, and transfer digital assets into attacker-controlled wallets (Business Today).

Polymarket’s administrators responded by placing the international exchange into a restricted ‘cancel-only’ mode, which allowed users to retract existing open bids but blocked new positions and order execution. Concurrently, the company halted its backend relayer infrastructure to sever the exploit path (Business Today). Polymarket confirmed that its core smart contracts were not compromised, stating the issue was isolated to external frontend dependencies. Trading operations were restored approximately an hour later after the vulnerability was identified and patched (Business Today).

Key Details

• Hackers exploited a third-party engineering flaw, draining at least $2.6 million from Polymarket user accounts on its international platform (Business Today).
• Individual user losses reached up to $800,000 in single instances, with funds rapidly moved from active balances (Business Today).
• The breach stemmed from a compromised web monitoring script from DebugBear, a UK-based third-party developer, executing unauthorised code to liquidate holdings (Business Today).
• Polymarket pivoted its international exchange into a ‘cancel-only’ mode and paused its backend relayer infrastructure to mitigate further losses (Business Today).
• Polymarket confirmed core smart contracts remained uncompromised, isolated the incident to external frontend dependencies, and pledged full reimbursement for affected traders (Business Today).

Why It Matters

This incident highlights the ongoing security vulnerabilities within digital asset platforms, particularly those relying on third-party integrations for their frontend operations. The exploitation of a web monitoring script, rather than core smart contracts, demonstrates how external dependencies can become critical points of failure, even for platforms with robust underlying blockchain security (Business Today). For B2B operators and regulators, the event underscores the importance of stringent security audits extending beyond core protocol architecture to encompass all integrated third-party services.

What’s Next

Polymarket has referred the breach to law enforcement authorities in the United Kingdom to pursue the perpetrators (Business Today). The company has also stated that all affected traders will receive full reimbursement for their lost balances (Business Today).