Polymarket said on October 29, 2026, that it had fixed an issue affecting Polymarket.com after a third-party provider was compromised. It said it had referred the incident to law enforcement and would make affected users whole, but did not say what caused the compromise. Users reported withdrawals without permission; one trader said he lost $800,000 and a friend lost about $600,000.
Polymarket’s status page showed a major trading API outage, with the exchange in cancel-only mode and relayer actions paused. Arkham data showed about $2.65 million in POL in a wallet flagged as the suspected attacker’s. Hudson Rock said a DebugBear-hosted script contained code that attempted to sell users’ positions and transfer assets, with that wallet address set as a fallback recipient. The researchers said they had not established how the compromise began or how many users were affected.
