@Polymarket put its international exchange into cancel-only mode on Thursday after users reported unauthorized withdrawals. The prediction market said one of its third-party providers had bee
@Polymarket put its international exchange into cancel-only mode on Thursday after users reported unauthorized withdrawals. The prediction market said one of its third-party providers had been compromised, referred the matter to law enforcement and promised to make every affected user whole. Trading resumed at about 3pm ET.
The incident affected Polymarket's international platform, not its separate US exchange. Prediction News reported that the offshore platform was hit, rather than the CFTC-regulated US entity.
According to Unchained, the exchange was in cancel-only mode by 2:05pm ET, with relayer actions paused. At 2:33pm ET, Polymarket said it had fixed an issue affecting its international platform, that one of its third-party providers was compromised and that the matter had been referred to law enforcement. Its status page marked the incident resolved at 3:05pm ET.
In cancel-only mode, users can cancel open orders but no new orders or trades are processed. Polymarket later said trading was fully back online and that it is fully reimbursing all affected traders.
Polymarket has not published a loss figure or named the provider. Blockchain analytics firm Arkham data cited by Decrypt shows a wallet flagged as the suspected attacker holds about $2.65 million in $POL, following multiple USDC.e-to-POL swaps through Relay. Other trackers have put the figure slightly higher, with one social media account alleging losses of $2.68 million, as reported by crypto.news.
A person familiar with the matter told CNBC the issue stemmed from a hack of DebugBear, a UK-based website performance monitoring company, according to a report by RG.org. DebugBear said it was impacted by an ongoing security incident and asked customers using its real user monitoring product to remove its embed code. Polymarket has not confirmed the provider's identity.
The breach follows a similar incident in June. Security firm Halborn reported that Polymarket users lost an estimated $3 million in a supply chain attack, in which the attacker compromised a third-party vendor to insert malicious code into the Polymarket frontend. The Defiant reported that the company pledged full refunds to fewer than 15 affected accounts.
The repeated pattern points to a wider risk for crypto platforms. Attacks routed through outside vendors can bypass smart contract code altogether, which means a platform's own audits may not catch them. Polymarket has not yet released a detailed technical report on the latest incident.
Unchained: Polymarket Resumes Trading, Vows to Reimburse TradersDecrypt: Polymarket Pauses Trading as Prediction Market Investigates Security IncidentHalborn: Explained, The Polymarket Hack (June 2026)
