Hackers Swipe Millions From Polymarket Users in Latest Security Breach
Traders who lost money on the incident will be ‘made whole,’ the prediction-markets platform said
- Polymarket paused trading on Thursday after some users of the prediction-market platform reported that their accounts had been drained of funds.
- A person familiar with the matter said the issue stemmed from a security flaw in DebugBear, a performance-monitoring vendor used by Polymarket.
- Polymarket stated that it fixed the issue related to the third-party vendor and that traders who lost money will be made whole.
At least $2.6 million in user funds was drained from Polymarket accounts on Thursday after hackers exploited an engineering flaw in the prediction market’s website.
The company confirmed that user funds were compromised, and briefly paused trading on its international exchange while it addressed the attack.
The hack is the latest in a string of similar security incidents that have plagued Polymarket this year as it struggled to keep a dominant position in Wall Street’s hottest market. The sudden popularity of “yes or no” wagers on everything from sporting events to election results has drawn a raft of scrutiny from states, federal lawmakers and casinos. Polymarket and its top U.S. rival, Kalshi, are ensnared in dozens of lawsuits over whether the markets constitute U.S.-regulated swaps or illegal betting.
The source of the latest breach: a security flaw in DebugBear, a third-party performance-monitoring tool used on Polymarket’s website, according to a person familiar with the matter. Polymarket has referred the issue to law enforcement in the U.K, where DebugBear is based, the person said.
A blockchain wallet belonging to a suspected attacker appeared to show more than $2.5 million in funds drawn from Polymarket user accounts, according to a Wall Street Journal review of wallet activity. The hackers withdrew funds from more than 700 accounts, the data showed.
DebugBear, whose website wasn’t accessible as of Thursday afternoon, didn’t respond to a request for comment. DebugBear posted on X earlier Thursday afternoon that it had been “impacted by an ongoing security incident” and advised customers who used one of its products to “remove the embed code from your website.”
The Journal reported in September that Polymarket’s U.S. platform had also faced at least two fraud attacks this year amid compliance failures and legal challenges. The company has discussed a potential IPO next year with investors, the Journal reported, and it has staffed its leadership with more seasoned executives in recent months.
Polymarket said in a statement after those X posts that it had fixed an issue related to a third-party vendor, and assured that traders who lost money would be “made whole.”
The company had faced a similarly costly security breach in June.