On October 29, 2026, attackers drained roughly $2.7 million from hundreds of accounts on Polymarket.com, the crypto-based international version of the prediction market, according to Casino.org and GamblingNews.com. Blockchain analytics firm Bubblemaps estimated that about 700 users were affected. Polymarket US was not the target.
None of the victims had to click a phishing link or leak credentials to lose money.
According to security researchers cited by both outlets, the attackers modified JavaScript hosted on the infrastructure of DebugBear, a website performance-monitoring provider. Because that script ran inside the genuine Polymarket site, it could reach logged-in trader sessions directly. DebugBear has acknowledged a security incident and asked customers of its Real User Monitoring (RUM) product to remove the embedded snippet from their websites.
Casino.org reports details that GamblingNews does not carry. According to Casino.org, the malicious code scanned active balances and open positions, liquidated holdings and sent the assets to an attacker-controlled wallet across three addresses, and the modified script was identified by Hudson Rock.
The figures differ by source. BleepingComputer traced transactions of about $2.57 million in Polygon's POL token from an attacker wallet. Bitquery, cited only by GamblingNews, put the figures at 737 users and $2.73 million.
Dividing the reported totals gives a rough average. $2.7 million across about 700 accounts comes to roughly $3,900 per affected user, and Bitquery's numbers give about $3,700. An average says nothing about the spread, though: a small number of large accounts could hold most of the losses, and no source has published the distribution. That gap matters because of the reimbursement terms Casino.org describes.
According to Casino.org, traders who lost more than $10,000 must reportedly sign a release agreement before being reimbursed, and, citing CNBC, those who lost less were to have their funds restored by Friday, October 30. Until Polymarket discloses how much of the loss sits in accounts above that line, it is not possible to say what share of the stolen sum would be repaid by Friday.
Polymarket has confirmed neither the number of victims nor the amount stolen.
The company acknowledged the attack, pledged to reimburse affected customers and referred the incident to law enforcement. GamblingNews reports that the referral went specifically to UK law enforcement. Trading stopped for about an hour before normal operations resumed; according to Casino.org, citing the platform's status page, Polymarket put the exchange into cancel-only mode at 2:05 p.m. ET on Thursday, with normal trading back by 3:05 p.m.
According to Casino.org, this is the second major supply-chain breach at Polymarket in four months, after a June 2026 vendor compromise that reportedly drained about $3 million from user wallets.
In a separate matter unrelated to the hack, GamblingNews reports that the Michigan Gaming Control Board has ordered Polymarket to leave the Michigan market by November 25, 2026.
Prepared with AI from independent sources and published automatically, without prior editorial review. How we use AI