Blockchain and wallet analyses cited by CNBC estimated that roughly $2.7 million was withdrawn from approximately 710 wallets on Polymarket’s international exchange. Polymarket’s U.S. platform was not reported to be affected.
The incident was attributed to a third-party provider rather than Polymarket’s own systems. Reporting by NBC News, The Wall Street Journal, and the Canadian Press linked it to DebugBear, a U.K.-based website-performance and monitoring provider whose code was embedded in the international platform.
How an Outside Tool Became the Attack Surface
Embedded tools like performance monitors and analytics scripts load alongside a site’s own code in users’ browsers. When a vendor’s infrastructure is compromised, malicious code can reach every visitor the platform serves.
The precise mechanism had not been confirmed. Available reporting did not establish whether it touched private keys, session credentials, or transaction permissions.
DebugBear acknowledged the problem publicly. According to NBC News, The Wall Street Journal, and the Canadian Press, the company said it was experiencing an ongoing security incident and advised customers using its monitoring embed to remove the code from their websites immediately.
Loss Estimates Remain in a Range
Blockchain and wallet analyses cited by CNBC put the figure at approximately $2.7 million across 710 wallets. Other analyses, cited by NBC News, placed the suspected theft between $2.5 million and $2.65 million.
Analysts were still refining estimates as of the available reporting, and the final loss total and confirmed victim count had not been independently verified.
Polymarket Halted Trading, Then Referred the Matter to U.K. Law Enforcement
Trading was temporarily suspended after users reported unauthorized withdrawals. The company said it identified and fixed the issue, then resumed operations at approximately 3 p.m. Eastern.
Polymarket referred the matter to U.K. law enforcement, a step linked to DebugBear’s location in the United Kingdom. Which specific authority received the referral was not confirmed in available reporting. Whether any investigation or asset seizure has begun remains equally unclear.
Reimbursement Is Promised, With Conditions for Larger Losses
Polymarket pledged to make affected users whole. According to CNBC’s reporting on the company’s Discord communications, losses below $10,000 were expected to be restored by October 30.
Users whose losses exceeded that amount would need to sign a release form before receiving reimbursement. A complete claims process and independently verified loss total had not been publicly released as of the available reporting.
A Pattern of Third-Party Risk, With Difficult Timing
The breach came ahead of the U.S. midterm elections, a period when prediction-market activity on platforms like Polymarket tends to increase. Vendor-risk controls and embedded-code oversight are now central questions facing the company.
What security changes Polymarket will implement remains unclear. How thoroughly it will audit third-party embeds going forward is equally unresolved. Readers concerned about embedded and third-party attack vectors can stay safe by reviewing guidance on minimizing exposure from external tools.
