Prediction market Polymarket suspended trading activity on Thursday (10/29/2026) around 18:05 UTC. The temporary halt and transition to cancel-only mode were triggered after the Central Limit Order Book (CLOB) application programming interface (API) suffered a major outage.
Panic ensued as multiple users took to X complaining about unauthorized balance deductions. A trader known as Car reported losing $800,000, while an associate suffered a $600,000 loss after their betting positions were abruptly dumped on the market. To halt further unauthorized transactions during the investigation, Polymarket also paused the relayer tasked with broadcasting signed user transactions to the Polygon blockchain.
The root cause of the disruption was not found in on-chain smart contracts, but rather in monitoring code embedded within the website’s frontend.
Injected Code in Monitoring Service
An investigation by cybersecurity research firm Hudson Rock identified a vulnerability in DebugBear, a third-party web performance monitoring service utilized by Polymarket. DebugBear’s script was injected with malicious code that hijacked active user login sessions. The unauthorized script then forced the sale of users’ open positions before exfiltrating the funds off the platform.
The attacker’s wallet at address 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18 accumulated roughly 2.65 million POL tokens, worth approximately $2.68 million, according to data from Arkham. The assets originated from victims’ deposited USDC.e balances, which were swapped via cross-chain bridge protocol Relay.
Reimbursement Pledge and Recurring Exploits
Polymarket confirmed the breach in an official statement, noting that the exploit has been reported to law enforcement. Developers removed the compromised script from the production web page and pushed a system patch. Trading services resumed normal operations in phases starting at 19:05 UTC, about an hour after the market was halted.
Management pledged to fully reimburse all affected users who suffered losses. The response mirrors an incident from June 2026, when malicious code was injected into Polymarket’s frontend, siphoning around $3 million in user funds before victims were made whole.
For platform traders, the reimbursement commitment guarantees that lost capital will be restored. However, the recurring incident underscores that vulnerabilities in third-party services remain a tangible risk capable of liquidating betting positions beyond an account holder’s control.
Reported via Decrypt.
Read also: Google Tests Crypto Custody for Banks - Alphabet Secures Its Own Ethereum and Solana
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
