Published
October 29, 2026
Polymarket.com traders lost an estimated $2 million to $2.7 million on October 29, 2026, when malicious code from a compromised third-party provider hijacked their logged-in sessions. Polymarket halted trading for about an hour and says everyone affected will be made whole; there is no lawsuit and nothing to claim.
What Happened?
At 2:05 p.m. Eastern on Thursday, October 29, 2026, Polymarket put its exchange into cancel-only mode and paused transactions “while we investigate an incident.” At 2:37 p.m. it said it had identified and fixed the problem on its international platform, Polymarket.com: “One of our third party providers was compromised, and we have referred this to relevant law enforcement.” Trading resumed around 3 p.m., and Polymarket marked the incident resolved at 3:05 p.m.Polymarket has not named the provider. Security researchers at Hudson Rock and BleepingComputer traced the malicious code to a script served from the content network of DebugBear, a website performance-monitoring service whose tracking code runs in visitors’ browsers. DebugBear posted that it was “impacted by an ongoing security incident” and told customers using its Real User Monitoring product to remove its code from their websites. Hudson Rock also found Polymarket build data indicating the DebugBear script was removed from the site at about 2 p.m.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
Status
Trading Restored · Reimbursement Promised
Halted 2:05 to about 3:05 p.m. ET, October 29, 2026 · referred to law enforcement
Estimated Loss
About $2 Million to $2.7 Million
Blockchain analysts’ estimates · Polymarket has not disclosed a figure
Can I Claim?
No — no lawsuit or claim process
Polymarket says affected traders will be made whole
How the Attack Worked
According to BleepingComputer’s analysis of the code, the script checked whether a visitor was logged in to Polymarket and then used that existing trading session to act on the account. It looked up the user’s balances and open positions, then tried to sell the positions or transfer the prediction-market tokens and other assets to a wallet the attacker controlled. Researchers said the method depended on how the user had signed in: accounts using Polymarket’s email login could have positions sold without a prompt, while users with their own crypto wallets would have been asked to approve a transfer.The script also sent data about targeted accounts back to DebugBear-hosted servers and took instructions from them, which BleepingComputer said raises questions about how much access the attackers had to DebugBear’s systems. Whether any other DebugBear customers were served the same code was not known as of October 30.
How Much Was Taken and Who Was Affected
Polymarket has not disclosed how much was taken or how many traders were hit, and a spokesperson declined to comment on the figure. Estimates from people tracking the attacker’s wallets vary:- BleepingComputer: about $2.5 million traced to the suspected attacker wallet, which moved about 28.6 million POL tokens on.
- DefiLlama, cited by CoinDesk: about $2.7 million.
- Hudson Rock: about $2.19 million held in the wallet when it checked, which it said is not a verified total.
Will Traders Be Reimbursed?
Polymarket says yes. Its status page said “anyone who has been impacted will be made whole,” and when trading resumed it posted: “We’ll make this right and are fully reimbursing all affected traders.” As of October 30, Polymarket had not said how reimbursements will be calculated or paid, or when, and no reports confirmed that payments had started.This was not Polymarket’s first front-end security incident this year. CoinDesk noted that the October losses came in just under the total from a separate incident in June 2026, after which Polymarket also promised refunds.
Could There Be a Lawsuit?
No lawsuit over the October 29 incident had been found as of October 30, and no law firm had publicly announced an investigation. If Polymarket repays affected traders in full as promised, there would be little left for a lawsuit to recover.Polymarket.com’s terms of use, effective August 11, 2026, also make a lawsuit harder. They are governed by the laws of Panama and send disputes to individual arbitration, with an option to opt out only within 30 days of agreeing to the terms. They bar users from taking part in a class action, disclaim liability for losses caused by hacking or by third-party services, and cap the company’s total liability at $100. Courts do not always enforce such terms in full.
Polymarket faces other legal scrutiny. It paid a $1.4 million civil penalty in a 2022 settlement with the Commodity Futures Trading Commission over unregistered event contracts, and Reuters reported on October 27, 2026, citing sources, that the agency is examining whether Polymarket violated that settlement. Polymarket and the CFTC declined to comment to Reuters. Separately, a consumer group has sued over Polymarket’s marketing, covered on OCA’s Polymarket fake bets and influencer lawsuit page.
Questions
How much was stolen in the Polymarket hack?
Polymarket has not disclosed a figure. BleepingComputer traced about $2.5 million to the suspected attacker’s wallet, and other blockchain analysts estimated roughly $2 million to $2.7 million.
Will Polymarket reimburse traders who lost money?
Polymarket said on its status page that anyone who has been impacted will be made whole, and posted that it is fully reimbursing all affected traders. It had not published how or when reimbursements will be paid as of October 30, 2026.
Was Polymarket US affected by the hack?
Polymarket said the incident affected its international platform, Polymarket.com. NBC News reported that the U.S.-based platform did not appear to be affected. Polymarket.com’s terms do not permit trading by U.S. residents.
Is there a class action over the Polymarket hack?
No lawsuit over the October 29, 2026 incident had been found as of October 30. Polymarket has promised to make affected traders whole, and Polymarket.com’s terms send disputes to individual arbitration under Panamanian law and include a class action waiver.
Sources
• Polymarket Status Page: Incident History• BleepingComputer: Polymarket Halts Trading After Crypto-Draining Script Breach
• Hudson Rock: Wallet-Draining Code Found in a Third-Party Script
• CoinDesk: Polymarket Suspends Trading After Third-Party Breach
• NBC News: Polymarket Trading Halted After Hack
• Polymarket Terms of Use
• CFTC: Order Against Blockratize (Polymarket), January 2022
For more class actions keep scrolling below.
Status
No Lawsuit Filed · Reimbursement Promised
Company
Polymarket (Polymarket.com international platform)
Incident Date
October 29, 2026
Estimated Loss
About $2 million to $2.7 million (analyst estimates)
Polymarket US
Did not appear to be affected, per NBC News
Can I Claim?
No — nothing to claim
Official Status
Polymarket Status Page
