Polymarket halts trading after vendor hack drains wallets

Polymarket stopped trading on its international exchange for close to an hour on Thursday, October 29, after users said their wallets had been emptied. The company blamed the breach on a compromised third-party provider and said it would repay everyone affected. NBC News reported that trading restarted at 3 p.m. ET. Polymarket's U.S. platform did not appear to be affected.nbcnews.com

"One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement," Polymarket said, adding that "anyone who has been impacted will be made whole". In a later post the company said, "We'll make this right and are fully reimbursing all affected traders".theverge.com+1

How the drain unfolded

A person familiar with the matter told The Wall Street Journal that the problem came from a security flaw at DebugBear, a performance-monitoring vendor whose code ran on Polymarket's website. The same person said the case went to law enforcement in the U.K., where DebugBear is based. CNBC Comcast Corporation ↗ 4.27% reported that DebugBear posted on X that it had been hit by a security incident.cnbc.com+1

Polymarket first switched the exchange to cancel-only mode. Users could cancel existing orders, but no new orders or trades went through, and relayer actions were paused during the investigation. The relayer handles token transfers and spending approvals for users' Polymarket wallets.finance.yahoo.com+1

According to BNO News, the malicious script read trading credentials from users' browsers. It then sold their open positions at steep discounts and sent the proceeds to the attacker.bnonews.com

Scale of the losses

One trader who posts on X as Car said he lost $800,000 and that a friend lost another $600,000. Neither figure has been independently verified. Arkham data showed a wallet linked to the suspected attacker holding about $2.65 million in POL Polygon Ecosystem Token ↘ 1.03% after it swapped USDC USD Coin for the token. The funds were later moved to other addresses. Cybersecurity firm Hudson Rock said that address was hardcoded as a backup recipient in the draining script hosted by DebugBear. Polymarket has not said how many users were affected.panews.io+3

A repeat problem before midterms

This is not the first time a vendor breach has hit Polymarket. In June, attackers altered outside-vendor code on its site and took about $3 million from fewer than 15 accounts, and the company refunded those users. Decrypt counted Thursday's breach as the platform's third security incident this year.finance.yahoo.com+1

The outage came days before the Nov. 3 U.S. midterm elections, when trading volume is expected to rise. Polymarket was valued at $21 billion in September. It is also looking into suspicious bets tied to Israel's elections and the midterms.nbcnews.com+1