Polymarket hack: $2.7 million stolen, trading halted

Prediction market platform Polymarket confirmed that about $2.7 million was stolen from the accounts of hundreds of users in a cyberattack on October 29. The platform had to suspend trading for a period during the attack. The system was later reopened.

The attackers targeted the company's crypto-based site for users outside the US, Polymarket.com. They altered the site's JavaScript code through third-party software. While users traded without noticing the change, the attackers moved in.

The attack also involved DebugBear, a performance monitoring tool. A modified script hosted on this tool exploited users' open sessions. This allowed the attackers to access wallets and sell assets or transfer them to wallets they controlled. Users lost funds without clicking a phishing link or having their passwords exposed.

Blockchain analysis firms reported different figures. Bubblemaps said 700 users were affected, while Bitquery put the number at 737 and the loss at $2.73 million. BleepingComputer tracked movements of about $2.57 million in Polygon POL from the attacker's wallet. Polymarket has not yet verified the number of affected users or the amount stolen, but it said it would cover the losses and referred the case to UK law enforcement.

The company also received difficult news on another front. The Michigan Gaming Control Board asked the platform to withdraw from the state market by November 25, 2026. The decision is seen as an important step in state regulators' effort to push back against prediction markets.