On Thursday, at least $2.7 million was taken from Polymarket accounts, and the attacker didn’t get in through the prediction market’s own systems. According to the company, a third-party provider it didn’t name was hacked, and that breach let someone take funds from some users of its international exchange.
Polymarket has contacted law enforcement and promised to pay back every trader who was affected. How many users were hit is still unclear. The company’s U.S. platform was not compromised.
Polymarket is paying back more than was stolen
Polymarket said Friday afternoon that 95% of affected wallets had already been refunded. The payout goes beyond the stolen amount.
“In total, we’re returning $3.9M to traders: the $2.7M plus $1.2M to cover pause-related losses,” Polymarket said.
That extra $1.2 million is for losses caused by the trading halt. Traders started posting on social media Thursday afternoon about withdrawals they hadn’t authorized, and the company then paused trading on its international platform. Polymarket said it fixed the problem on its side, and trading came back at 3 p.m. ET on Thursday.
Larger accounts face an extra step. In a Discord chatroom later on, Polymarket told users that losses under $10,000 will be restored by Oct. 30. Users who lost more than that have to sign a release form before they’re repaid.
The breach came through a website monitoring tool
According to a person familiar with the matter, the breach traces back to a hack of DebugBear, a platform that monitors website performance. DebugBear said in a post on X that it suffered a security incident on Thursday.
Since DebugBear is a U.K. company, Polymarket sent the case to U.K. law enforcement, the same person said. DebugBear didn’t immediately respond to a request for comment.
Betting Intelligence and Polysights, two analytics firms, reviewed the publicly available data. They found that on Thursday a single Polymarket account withdrew at least $2.7 million across 710 other wallets.
“This is certainly a significant and new form of breach that we’ve seen on Polymarket,” said Dan Zimmermann, chief intelligence officer at Betting Intelligence. “The timing right before the midterms …is certainly a wake up call for folks.”
The second vendor breach this year
Polymarket has been here before. In June, the company said a third-party vendor had been “compromised” and that it would refund the users affected.
The timing is bad. The international and U.S. exchanges are both expected to handle more volume around the U.S. midterm elections on Nov. 3, and this disruption hit only days earlier.
The international exchange is a decentralized finance platform on the Polygon blockchain, and it isn’t regulated in the U.S. Traders there who lost more than $10,000 should read the release form closely before they sign it.