Polymarket Resumes Trading After Third-Party Breach Drains About $2.7 Million

Polymarket restored trading on its international platform on Thursday, 29 October 2026, after a breach at a third-party data provider led to unauthorized withdrawals that analytics firms estimate at about $2.7 million.

The crypto-based exchange said it fixed the problem on its end and that full trading resumed at 3 p.m. ET. It has contacted law enforcement and pledged to reimburse any affected trader, according to CNBC.

What happened on 29 October

Traders first flagged the problem on social media, reporting that funds were leaving their wallets without their authorization. Polymarket then reported an outage on the international exchange and attributed it to the hack of an outside data provider.

According to CCN, the exchange switched to cancel-only mode at about 18:05 UTC. In that mode users can pull existing orders but cannot place new ones. FinanceFeeds reports that Polymarket flagged the fix at 18:37 UTC, and trading came back at 3 p.m. ET.

How large was the loss

Polymarket has not published its own total, so the figures below come from outside trackers. They are close to one another but not identical.

CNBC reported that it was unclear how many users were affected. For traders, the practical question is the reimbursement pledge: Polymarket has said any affected trader will be made whole, but the reports reviewed carry no published timetable.

How the compromise worked

The reports describe a vendor-side breach rather than an attack on Polymarket's own website. Wired, as summarized by Slashdot, says a third-party vendor based in the United Kingdom was breached. CCN reports that malicious code linked to a third-party monitoring script exploited sessions where users were already logged in, selling positions and transferring assets out.

Dig.watch says the exchange reported no evidence that wallet private keys were leaked. That distinction matters for how the incident is classified. A breach in a supply-chain component that runs inside a user's browser session is a different failure from a stolen key or a drained smart contract, and it points to vendor risk controls rather than wallet custody.

Polymarket US was not involved

Polymarket runs two separate businesses. Polymarket US operates as a federally regulated financial exchange inside the United States. The flagship international platform is crypto-based and banned in the US and a number of other countries, according to Wired. Dig.watch reports that the incident did not affect Polymarket US.

The split has a history. The international product has drawn scrutiny from European authorities before: Gamingo reported on France's moves toward a ban on Polymarket and on Polymarket blocking French users during an investigation by the Autorité nationale des jeux (ANJ), France's gambling regulator. In the US, state gaming bodies have also examined event contracts, as in Michigan's inquiry into sports prediction markets.

What operators and vendors should take from it

The incident is a reminder that third-party scripts running on trading and betting front ends sit inside the security perimeter, whatever the contract says. Wired says this is not the first time Polymarket traders have suffered losses of this kind, and Dig.watch likewise notes earlier incidents involving an external provider.

For operators of crypto-linked products, the points to review are concrete:

• Script inventory: list every third-party script loaded in authenticated sessions, including monitoring and analytics tools.
• Session controls: limit what a logged-in session can do without a fresh confirmation, especially selling positions and moving assets.
• Incident playbook: a cancel-only mode, as used here, lets a platform stop new activity without freezing user exits.
• Customer remediation: a public reimbursement commitment and timetable reduces uncertainty for affected users.

Oversight of crypto trading platforms in Europe has been a policy theme for some time, as Gamingo noted in its coverage of European measures to govern cryptocurrency trading. No regulator reaction to this incident has been reported so far.

Status reviewed on 30 October 2026. Figures come from CNBC, Wired via Slashdot, and estimates by analytics firms cited in news reports. More business news and North America coverage.