Polymarket Reimburses Traders After Third-Party Breach Drains Millions Ahead of Midterms

Popular prediction market platform Polymarket has moved swiftly to reimburse international traders following a security breach that compromised user accounts and resulted in stolen funds on Thursday. The incident, which stemmed from an external hack involving a third-party service provider, sent ripples through the decentralized finance community just days before major trading volume is expected to flood the market ahead of the upcoming U.S. midterm elections.

The disruption first came to light on Thursday afternoon when users of Polymarket’s international exchange began sharing alerts on various social media platforms, reporting unauthorized withdrawals from their wallets. In response to the emerging threat, the company acted quickly to halt trading on its international platform to contain the breach and protect other users from potential losses.

By Friday afternoon, Polymarket reported that it had successfully refunded 95% of the affected wallets, demonstrating a rapid financial recovery effort to restore trust among its user base. In a public statement detailing the resolution, the company broke down the financial allocation for the recovery process.

"In total, we’re returning $3.9M to traders: the $2.7M plus $1.2M to cover pause-related losses," Polymarket stated, highlighting its commitment to making whole every trader affected by both the unauthorized withdrawals and the mandatory platform shutdown.

According to data and timelines shared by the platform, trading resumed at 3 p.m. Eastern Time on Thursday after engineers successfully fixed the vulnerability on Polymarket’s end. For the reimbursement process, the company communicated directly with affected users via a Discord chatroom, outlining specific tiers for restoring funds. Users who had less than $10,000 taken from their wallets were told they would have their funds automatically restored by Oct. 30, while individuals who suffered losses greater than that threshold are required to sign a release form before their accounts are fully credited.

While Polymarket’s own infrastructure was not structurally compromised, and its separate U.S. platform remained entirely unaffected by the security event, the source of the breach lay outside the company’s direct control. A person familiar with the matter told CNBC that the security compromise originated from a hack targeting DebugBear, a website performance monitoring platform. DebugBear acknowledged the security incident in a public post on X on Thursday. Sources familiar with the situation indicated that Polymarket referred the matter to law enforcement authorities in the United Kingdom, where DebugBear is headquartered. DebugBear did not immediately respond to requests for comment regarding the incident.

Independent data analysis sheds further light on the scale and execution of the breach. An examination of publicly available blockchain data conducted by two analytics firms, Betting Intelligence and Polysights, and provided to CNBC, revealed that a single account on Polymarket managed to withdraw at least $2.7 million across 710 distinct wallets on Thursday.

Industry analysts have pointed out the unique nature and alarming timing of the attack. Dan Zimmermann, the chief intelligence officer at Betting Intelligence, emphasized the gravity of the situation in light of the platform’s current operational landscape.

"This is certainly a significant and new form of breach that we’ve seen on Polymarket," Zimmermann said. "The timing right before the midterms … is certainly a wake-up call for folks."

Polymarket’s international prediction market exchange operates as a decentralized finance platform built upon the Polygon blockchain and remains unregulated within the United States. Because of its decentralized architecture and global accessibility, it relies heavily on external vendors and third-party integrations to manage various digital infrastructure tasks, which can sometimes introduce vector vulnerabilities outside the core development team’s immediate oversight.

The timing of the security disruption is particularly sensitive for the platform, occurring just days before both Polymarket’s international exchange and its U.S. platform are anticipated to experience unprecedented levels of trading activity and high-stakes market volumes tied to the U.S. midterm elections scheduled for Nov. 3. Prediction markets have increasingly become primary hubs for political forecasting and speculative betting, drawing significant financial capital and global media attention during major electoral cycles.

This week’s incident is not the first time Polymarket has had to contend with external vendor vulnerabilities. In June, the platform experienced a similar security scare when Polymarket management reported that a third-party vendor had been compromised. At that time, the company similarly pledged to absorb the impact and fully refund all affected users, establishing a precedent for handling external supply chain attacks that target its ecosystem.

As Polymarket finalizes the remaining 5% of its wallet reimbursements and prepares for the massive influx of traffic expected ahead of the Nov. 3 elections, the company has contacted law enforcement agencies to assist in investigating the DebugBear breach. Meanwhile, traders and industry observers continue to monitor the platform closely, emphasizing the heightened security risks facing decentralized finance platforms during peak political and financial events.