Polymarket Restores Trading After Third-Party Vendor Breach

Polymarket restored its international exchange on October 29 after a one-hour halt triggered by a security breach linked to a compromised third-party website supplier. According to CryptoNews, security researchers and firms identified a monitoring script loaded by the website that attempted to access logged-in accounts to sell positions and move assets.

During the disruption, which lasted from 18:05 to 19:05 UTC, traders reported unauthorized transactions and positions being sold before they intended to close them. One trader named Car stated that approximately $800,000 disappeared from his Polymarket account and all his positions were sold. Another tracking account estimated that a suspected recipient wallet accumulated $2.68 million during the hour of unauthorized activity.

Platform Response and Recovery

Polymarket moved its exchange into cancel-only mode and paused relayer actions while investigating the issue. The company confirmed that a third-party provider had been compromised, fixed the issue, and referred the incident to law enforcement in the United Kingdom. DebugBear was identified as the third-party provider involved through its website monitoring service, and the supplier advised customers to remove its embed code.

The company stated it would reimburse affected customers, though the reimbursement pledge did not initially specify how sold positions would be valued or confirm individual loss totals. The incident marked the second vendor-related security issue for the platform in four months following a similar event in June.

Key facts

• Polymarket experienced an international trading halt on October 29 from 18:05 to 19:05 UTC.
• Security researchers linked the breach to a compromised performance-monitoring script from a third-party supplier, identified as DebugBear.
• The malicious code attempted to access logged-in trading client and signer tools to sell positions and transfer assets.
• Polymarket confirmed the third-party compromise, restored service, and promised full reimbursements to affected users.