Polymarket, a platform specializing in prediction markets, announced it has resolved an issue affecting its international site following a breach involving a third-party provider. The company stated it will fully compensate any users impacted by the incident, which led to a temporary suspension of trading activities.
Incident Details and Immediate Response
The disruption began when Polymarket detected suspicious activity linked to a third-party script used for monitoring website performance. Researchers from Hudson Rock reported that the compromised code could enable the unauthorized sale of user positions and withdrawal of funds. In response, Polymarket removed the problematic script from its codebase and shifted the exchange into cancel-only mode, pausing all trading and relayer actions, including user-initiated transactions and position redemptions.
Ongoing Investigation and Law Enforcement Involvement
Polymarket has referred the incident to law enforcement authorities for further investigation. The company has not disclosed the total amount affected, though at least one user reported a significant loss. Polymarket emphasized that it has identified and fixed the vulnerability and that trading will resume once the platform is deemed secure.
Implications for Industry Stakeholders
This incident highlights the potential risks associated with integrating third-party services into iGaming and prediction market platforms. Operators and affiliates are reminded of the importance of rigorous vetting and continuous monitoring of external software components. For regulators, the event underscores the need for oversight regarding third-party dependencies within licensed platforms.
Key takeaways
- Polymarket resolved a security issue caused by a third-party breach on its international platform.
- Trading was suspended and the exchange entered cancel-only mode during the investigation.
- The company pledged to fully compensate affected users and involved law enforcement.
- The incident underscores the importance of third-party risk management for operators and affiliates.
Update (30.10.2026)
GoPlus reported that around $2.71 million was stolen from Polymarket users during the October 29 attack, impacting 710 deposit wallets and 731 addresses. Polymarket has pledged to compensate users with losses under $10,000 by October 30, while those with greater losses must sign a waiver of claims to receive reimbursement, according to CNBC. DebugBear confirmed the breach and advised clients using its RUM product to remove its code. Hudson Rock researchers found no evidence that other sites were affected.