Polymarket pauses international trading after reported unauthorized withdrawals
Polymarket said a compromised third-party partner prompted a trading pause, and it pledged to reimburse affected international users.
By Theo Nakamura · Staff Writer
· 3 min read
Polymarket hack reimbursements are planned after users of the company’s international platform reported unauthorized wallet withdrawals on Thursday. Polymarket said a third-party partner had been compromised, paused trading as a precaution, and later resumed the service at 3 p.m. ET, according to CNBC and The Verge.
For users, the immediate takeaway is that the reported incident involved Polymarket International, rather than the separate U.S. exchange. CNBC reported that the U.S. platform was not compromised. It was unclear how many users were affected.
Polymarket said it would fully reimburse affected traders, The Verge reported. CNBC said the company later told users in a Discord chat that those with less than $10,000 taken from their wallets would have funds restored by Oct. 30. Users with more than $10,000 taken were told they would need to sign a release form to receive restoration, CNBC reported.
What happened in the Polymarket security incident?
Traders began posting on social media Thursday afternoon that money had left their wallets without authorization, CNBC reported. Polymarket then halted trading on its international exchange. The company said it fixed the problem and reopened trading later that day.
The company’s public explanation was limited to a compromised third-party partner or vendor. CNBC, citing a person familiar with the matter, reported that the issue stemmed from a security incident at DebugBear, a website-performance monitoring provider. DebugBear said in a post on X that it had experienced a security incident that Thursday, CNBC reported.
The same person told CNBC that Polymarket had referred the matter to U.K. law enforcement because DebugBear is based in the U.K. That account was not a statement from Polymarket or a U.K. authority, and the reporting did not establish that a formal U.K. investigation had begun.
What is known about the reported losses?
Two analytics firms, Betting Intelligence and Polysights, told CNBC that one account withdrew at least $2.7 million across 710 other wallets on Thursday. That is an analysis of public blockchain data, not a confirmed total of funds taken or a confirmed count of affected customers.
Polymarket International is a non-custodial blockchain-based prediction-market platform for users outside the U.S. and other restricted jurisdictions, according to Polymarket’s transparency page. Non-custodial means users hold their own private keys, while collateral for open positions is held in a smart contract rather than by Polymarket. Polymarket says its U.S. service is a separately operated, federally regulated exchange.
The disruption came after a separate June incident in which Polymarket said a third-party vendor had been compromised and said it would refund affected users, CNBC reported. The prior event should not be conflated with Thursday’s incident: a roughly $3 million June estimate reported by The Defiant concerned that earlier breach.
This story draws on original reporting from CNBC.
