Polymarket hacked: about $2.7 million taken from 737 accounts through a compromised third-party script, and what users should do

Polymarket's international platform was hacked on Thursday, 29 October 2026. Attackers drained about $2.7 million from user accounts on Polymarket.com in roughly an hour, after a script from an outside provider that the site loaded was compromised. Polymarket halted trading, fixed the problem and says it will reimburse everyone affected.

"We've identified & fixed an issue impacting our international platform, Polymarket.com," the company wrote on X. "One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement. Anyone who has been impacted will be made whole."

Here is what is known about the attack, who was hit and what users should do now.

What happened

Sources: Polymarket's statements on X; analyses by Bitquery, Hudson Rock and DefiLlama's 0xngmi as reported by CCN, Bitcoin.com and Business Today.

How the attack worked

Polymarket has not named the provider. Security researchers have filled in much of the picture:

• The weak point was a script, not Polymarket's own code. Hudson Rock, a cybersecurity firm, said the malicious JavaScript was served through infrastructure belonging to DebugBear, a website performance-monitoring service whose script Polymarket's pages loaded. Hudson Rock obtained copies of the file.
• Visitors were the target. As 0xngmi, the developer behind DefiLlama, put it, the attacker compromised "a company that does web performance tracking and whose scripts were being pulled on Polymarket, so everyone who visited polymarket got exposed." The code tried to take over logged-in sessions and move funds out.
• Seed phrases were not exposed. 0xngmi said users' seed phrases remained safe. Business Today reported that Polymarket confirmed its core smart contracts were not compromised.
• The script was pulled quickly. According to the analysis reported by CCN, metadata from Polymarket's production build shows the monitoring script was removed at 17:59 UTC.

This kind of attack, through a supplier rather than the target itself, is known as a supply-chain attack. It does not require breaking the platform's smart contracts or stealing its keys: it uses the trust a website places in code it loads from elsewhere.

The losses

Estimates differ a little by source:

• Bitquery counted about $2.73 million in unauthorized withdrawals from 737 accounts, in 985 withdrawals, most of them between 17:10 and 18:10 UTC. Four accounts made up about 43% of the stolen amount; 276 accounts lost less than $100 each. Shares belonging to 33 users were also taken.
• 0xngmi tracked about $2.7 million of losses.
• Business Today put the total at "at least $2.6 million" and cited Arkham, a blockchain analytics firm, for more than 900 malicious transactions routed through the platform's relayer before the funds were swapped into Polygon's POL token.

Polymarket has not published its own figures. The two headline numbers, about $2.7 million and about 737 accounts, are consistent across the on-chain analyses. Many victims lost small amounts, while a handful of large accounts make up much of the total.

How Polymarket's international site holds your money

Polymarket.com is the crypto-based version of Polymarket. Balances are held in pUSD, a dollar token backed one-for-one by USDC, on the Polygon network, and trades are signed from the user's wallet through the website. That design is why a malicious script running in the browser was dangerous: code that can act inside a logged-in session can try to sign withdrawals on the user's behalf.

It is also why the damage was limited to people who used the site during the window. The analyses so far point to session takeovers, not to a flaw in Polymarket's smart contracts or its market resolution system. Arkham said the stolen funds were routed through the platform's relayer and swapped into Polygon's POL token.

The timeline

Times as reported by CCN and Bitcoin.com; some reports gave a later restart time.

Will users get their money back?

Polymarket says yes. Its statements: "Anyone who has been impacted will be made whole," and "we'll make this right and are fully reimbursing all affected traders." The company has not yet published a timetable or the mechanics of the refunds. It said it had referred the matter to law enforcement; Business Today and Reuters reported that UK authorities are involved.

If you think you were affected:

1. Check your activity history on Polymarket.com for withdrawals you did not make on 29 October.
2. Contact support through the chat on the website or at [email protected], and keep any messages you get from Polymarket.
3. Watch out for scams. After every hack, fake "refund" sites and direct messages appear. Polymarket will not ask for your seed phrase or private key. Only use links from polymarket.com or its official X accounts.

What it meant for trading

The halt lasted about an hour, in the middle of the busiest week of the year for election markets. Trading carried on afterwards: in the 24 hours to Friday afternoon, 30 October, Polymarket's international markets traded about $65 million, by our count of its public market data, with the House and Senate control markets at the top. Our study of what traders bet on breaks that volume down by category.

By Friday afternoon Polymarket's price for Democrats to win the Senate stood at about 72.5%, close to Kalshi's 70.5%, so the two venues were still pricing the election alike.

Was Polymarket US affected?

Every statement and report refers to the international platform, Polymarket.com. None mentions the separate, CFTC-regulated Polymarket US app, which runs on its own systems with US-dollar accounts. US users should still check their accounts, but there is no report of losses there. More on the difference: how to use Polymarket in the US.

Polymarket's second incident this year

This is not Polymarket's first security problem in 2026. In May, about $700,000 was stolen after attackers compromised a six-year-old private key used for internal operations, according to Bitcoin.com. Polymarket said then that customer funds, smart contracts and market resolution were not affected, rotated the key and said it would move to a more secure key management system. CCN also cited a separate third-party attack in June of about $3 million.

Two incidents in six months will raise questions about how the company vets the outside code and services it relies on, at a time when it is weighing an IPO or a token and handling record midterm volume.

What platforms can do about third-party scripts

Most websites load code from outside companies for analytics, performance monitoring, chat or advertising. Each of those scripts runs with the same access as the site's own code, so a breach at any supplier becomes a breach of the site. Standard defences exist:

• Subresource Integrity (SRI), which lets a site pin the exact version of an outside script by its hash, so a modified file is refused by the browser.
• A strict Content Security Policy, which limits which domains can run code on a page and where data can be sent.
• Keeping sensitive pages lean, with no third-party scripts at all on pages that can move money.

Polymarket has not said what it will change. Its statement says only that it has "identified and fixed" the issue. Users will be looking for a fuller explanation, along with the refund details.

How to protect your prediction market account

The attack hit people simply for visiting the site while logged in, so there was little individual users could have done. Some habits still limit the damage:

• Keep only what you trade on the platform. Withdraw winnings you are not using; a smaller balance means a smaller loss.
• Use a hardware wallet or strong two-factor authentication where the platform supports it.
• Never share your seed phrase or private key, and be suspicious of any site or message that asks for it.
• Log out of trading sites you are not using.
• Check your account after any incident and report anything odd quickly.

Our guides cover the basics: Polymarket support, Polymarket withdrawals and is Polymarket down?.

Frequently asked questions

Was Polymarket hacked?
Yes. On 29 October 2026 a compromised third-party script on Polymarket.com let attackers take about $2.7 million from 737 accounts, according to on-chain analysis.

Is Polymarket safe to use now?
Polymarket says it has identified and fixed the issue, and researchers say the script was removed within the hour. As with any platform, keep only what you need on it and use the security features it offers.

Will I get my money back?
Polymarket says everyone affected "will be made whole." It has not yet published how or when.

Did the hack affect Kalshi?
No. Kalshi is a separate company with its own systems; nothing in the reports involves it.

Key points

• On 29 October 2026, attackers took about $2.7 million from 737 Polymarket.com accounts in about an hour.
• The entry point was a compromised third-party script; researchers linked it to the performance-monitoring provider DebugBear.
• Polymarket halted trading for about an hour and says affected users "will be made whole."
• There are no reports that the separate Polymarket US app was affected.
• It is Polymarket's second security incident of 2026, after a $700,000 theft in May.

Related reading

• Polymarket support: how to contact them
• How to use Polymarket in the US
• How to delete your Polymarket account
• Who owns Polymarket?
• Kalshi vs Polymarket

This article is based on Polymarket's statements and third-party analyses published on 29 and 30 October 2026; figures may change as Polymarket completes its own review.