Polymarket stolen funds: One account withdrew at least $2.7M across 710 wallets

What it is

On 29 October 2026, users of Polymarket's international exchange reported unauthorized withdrawals, some claiming losses of hundreds of thousands of dollars. Polymarket attributed the incident to a compromised third-party service provider. A person familiar with the matter told CNBC the provider was DebugBear, a website performance monitoring platform. DebugBear separately confirmed on X that it had a security incident on 29 October.

Scope and response

Betting Intelligence and Polysights analyzed public data and found one account withdrew at least $2.7 million across 710 other wallets. The page's wording suggests the funds were drawn from those wallets, which implies the many victims were hit from a single account.

Polymarket entered cancel-only mode, paused relayer actions and halted international trading. It said it identified and fixed the issue on its side, and international trading resumed at 3 p.m. ET the same day. Its U.S. platform was not compromised. The company referred the case to law enforcement, reportedly U.K. authorities because DebugBear is based there, and promised full reimbursement.

Preconditions / Affected

Only the international exchange is affected. It runs on the Polygon blockchain as a decentralized finance platform and is not regulated in the U.S. Both exchanges are expected to see heavier volume ahead of the U.S. midterm elections on 3 November.

Caveats

The DebugBear link comes from an anonymous source speaking to CNBC. Polymarket's own statement names no vendor. The page does not say how the provider compromise led to withdrawals, which credentials or components were exposed, or whether users need to take any action such as revoking approvals. A June 2026 third-party vendor breach led to about $3 million in stolen user funds, and Polymarket said it fixed that vulnerability and would reimburse users.