Polymarket Resumes Trading After $2.7 Million Theft Hit 710 Wallets

Q: Why does Polymarket keep refunding users after vendor-linked hacks, and what still hasn’t changed since its similar June compromise?

Polymarket keeps refunding users because the thefts appear to stem from vendor or website-layer compromises rather than failures in its core on-chain exchange contracts, and the company has decided that making users whole is necessary to preserve trust ahead of major trading periods. In both the latest incident and the June episode, the losses were tied to third-party code or infrastructure that attackers allegedly used to inject malicious frontend behavior and trick users into signing unauthorized transactions. Polymarket has said its U.S. platform and core smart-contract system were not breached. What has not changed since June is the basic exposure to third-party and frontend risk. Despite audits of its core contracts and earlier promises to tighten monitoring, Polymarket’s international platform was again vulnerable to a supply-chain style attack through an outside provider, this time reportedly DebugBear. The attack path looks similar: malicious code at the website layer, suspicious wallet-signature prompts, and user funds drained without a direct smart-contract exploit. So the repeated refunds reflect a business decision to absorb losses caused by infrastructure around the exchange, while the unresolved problem is that the user-facing web layer still depends on external services that can become a weak point. That is why the latest breach is being seen less as a one-off and more as evidence that the same structural security gap from June had not been fully eliminated.

1 articles · Updated · CNBC · Oct 29

Trading on Polymarket’s international exchange resumed at 3 p.m. ET after the platform halted activity when users reported unauthorized withdrawals from their accounts.
DebugBear, a third-party website performance provider, was identified by a person familiar with the matter as the source of the breach; Polymarket said it fixed the issue on its end.
$2.7 million was withdrawn across 710 wallets, according to analysis by Betting Intelligence and Polysights, though the number of affected users remains unclear.
Polymarket said its U.S. platform was not compromised, has contacted law enforcement in the U.K., and pledged to reimburse any affected trader.
The disruption hit days before the Nov. 3 U.S. midterm elections, a period expected to drive heavier trading volumes, and follows a similar third-party vendor incident in June.