Polymarket Pauses Trading After Hackers Steal $2.7 Million via Third-Party Compromise
Reports say that Polymarket was hacked on October 29 when hackers are said to have siphoned roughly $2.7 million from hundreds of accounts by compromising DebugBear. The company temporarily canceled trading for an hour, promised reimbursement and referred the incident to UK law enforcement. Michigan ordered Polymarket to exit by November 25, 2026.
SCCG Take — This breach exposes third-party integration risks in prediction markets, while the Michigan order underscores fragmented US regulatory barriers. Operators must secure external tools and map state compliance to protect liquidity and access.
Polymarket temporarily canceled trading after hackers stole roughly $2.7 million from hundreds of accounts on its international platform. The breach occurred on October 29 and forced a one-hour operational pause before trading resumed. It targeted the crypto-based exchange Polymarket.com rather than the company's US-facing site, according to reporting by GamblingNews.
Attack Exploited Modified JavaScript from DebugBear Tool
A third-party performance monitor called DebugBear had its script altered, allowing hackers to tamper with the website's JavaScript code. This compromised existing logged-in sessions, enabling attackers to access customer wallets and transfer or sell assets without users clicking phishing links or leaking passwords.
Blockchain analytics firms tracked the impact with varying results. Bubblemaps reported 700 affected users. Bitquery placed the totals at 737 users and $2.73 million stolen. BleepingComputer traced roughly $2.57 million in Polygon's POL cryptocurrency from a suspected attacker wallet.
Polymarket has not confirmed the precise number of customers impacted or the exact damages. The company acknowledged the attack, committed to reimbursing affected users, and referred the matter to UK law enforcement. DebugBear instructed clients to remove its Real User Monitoring code from websites to avoid further risks.
Michigan Exit Order Compounds Platform Challenges
Separately, the Michigan Gaming Control Board ordered Polymarket to cease sports event contracts by November 25, 2026. The directive marks a clear regulatory win for the board in its oversight of the prediction markets sector.
The paired events reveal concrete vulnerabilities at the intersection of technical dependencies and state enforcement. Prediction platforms must now treat third-party code as a direct attack vector while mapping explicit compliance paths in each jurisdiction to limit exposure and sustain operations.
Gaming, betting and prediction markets — the desk’s read, every weekday.
Subscribe →