Prediction market giant Polymarket temporarily suspended its international platform operations on Thursday after hackers leveraged a third-party engineering flaw, resulting in the theft of at least $2.6 million from user accounts. The incident unfolded rapidly, with affected users reporting unauthorized withdrawals and sudden balance liquidations, some individual losses reaching up to $800,000.
The Exploit's Mechanics
The breach was traced to a compromised web monitoring script provided by DebugBear, a UK-based third-party developer. Attackers embedded unauthorized code into Polymarket's frontend, enabling them to scrape active user trading sessions, liquidate open holdings, and route converted digital assets directly into attacker-controlled wallets.
On-chain analysis conducted by Arkham revealed over 900 malicious transactions. These transactions were routed through Polymarket's relayer infrastructure before funds were ultimately swapped into Polygon's native POL token, highlighting the sophisticated nature of the attack.
Polymarket's Swift Response
In immediate response to the unfolding exploit, Polymarket administrators quickly pivoted its international exchange into a restricted "cancel-only" mode. This critical measure blocked new incoming positions and order execution while still allowing traders to retract existing open bids. Simultaneously, the company paused its backend relayer infrastructure, the automated service responsible for batching and executing user transactions on-chain, effectively severing the exploit path.
Polymarket confirmed that the platform's core smart contracts remained uncompromised throughout the ordeal, noting that the incident was isolated entirely to external frontend dependencies. Trading operations were fully restored approximately an hour later after technical teams successfully identified and patched the underlying vulnerability.
Reimbursements and Law Enforcement
The company issued a statement confirming that "one external partner was compromised" and reassured users that all affected traders will receive full reimbursement for their lost balances. Polymarket has also referred the breach to law enforcement authorities in the United Kingdom to pursue the perpetrators responsible for the large-scale digital theft.