Polymarket to Reimburse US$3.9 Million Following Cyberattack
United States.- 3 November 2026 | www.zonadeazar.com Polymarket, the international prediction market platform, has announced approximately US$3.9 million in compensation for traders affected by a cyberattack on 29 October 2026.
The incident compromised hundreds of digital wallets through malicious code delivered via an external technology service used by the platform.
Website performance monitoring company DebugBear confirmed that its DNS records were compromised through its domain registrar, although the precise circumstances of the attack remain under investigation.
Cyberattack Forces Trading Suspension
On 29 October, Polymarket temporarily suspended trading on its international platform after receiving reports of unauthorised withdrawals.
The company identified a security issue involving a third-party provider and removed the compromised component within an hour.
The incident affected traders who were logged into the platform.
Attackers exploited active sessions to perform unauthorised transactions involving digital assets.
Following its security response, Polymarket resumed operations and began compensating affected users.
Malicious JavaScript Enables Asset Transfers
Cybersecurity researchers at Hudson Rock linked the attack to malicious JavaScript distributed from an address associated with DebugBear.
The code was loaded when traders accessed Polymarket while maintaining an active session.
Once executed, it could:
- Examine users’ trading portfolios.
- Sell positions without authorisation.
- Transfer assets to wallets controlled by attackers.
- Exploit trading permissions associated with active sessions.
Researchers explained that the attackers did not necessarily need to obtain wallet private keys to execute fraudulent transactions.
Polymarket Identifies 726 Affected Wallets
In an update published on 30 October, Polymarket confirmed that 726 digital wallets had been directly affected.
At that point, the platform had completed reimbursements for 689 wallets.
The remaining 37 wallets were awaiting verification before the corresponding payments could be processed.
Approximately US$2.7 million in assets had been stolen directly.
The company committed to completing the reimbursement process for affected traders.
Additional US$1.19 Million for 5,500 Wallets
Beyond the assets stolen directly by the attackers, Polymarket also announced compensation for the operational consequences of the incident.
Approximately US$1.19 million will be distributed across 5,500 wallets.
These payments are intended to cover traders affected by the temporary trading suspension or by positions sold or transferred through the malicious code.
The compensation programme comprises:
- US$2.7 million: assets stolen directly.
- US$1.19 million: additional losses associated with trading disruption and unauthorised transactions.
- US$3.9 million: total approximate compensation commitment.
The initiative aims to address both direct theft and certain additional financial consequences.
DebugBear Confirms DNS Hijacking
DebugBear, a company specialising in website performance monitoring, confirmed that its DNS records were compromised through its domain registrar.
The Domain Name System (DNS) connects domain names to their corresponding servers.
By manipulating these records, attackers can attempt to redirect website requests towards infrastructure under their control.
According to DebugBear, preliminary findings suggest the attackers specifically targeted one customer’s website.
However, the company stressed that this remains an initial conclusion.
DebugBear has not publicly identified the customer concerned, while Polymarket has not officially named the compromised third-party provider.
No Evidence of Private Key Theft
One of Hudson Rock’s principal findings was that the attackers appeared to exploit permissions associated with active trading sessions.
Although the malicious code accessed credential-related information stored in browsers, researchers found no evidence that passwords, recovery phrases or private keys were transmitted to the attackers.
This suggests that unauthorised transactions could be executed without directly stealing those credentials.
The distinction is important for understanding the attack and the security controls required to prevent similar incidents.
Polymarket Investigates Alongside Authorities
Polymarket confirmed that it is investigating the incident in cooperation with law enforcement authorities.
The company also intends to publish a technical post-incident report, or postmortem, explaining what happened and detailing its response.
DebugBear is conducting its own investigation into how its DNS records were compromised.
The company reported finding no evidence that its internal systems had been breached.
The incident also disrupted its ability to receive emails addressed to its domain.
Second Similar Incident in 2026
The October attack was not Polymarket’s first incident of this nature during the year.
In June 2026, the company reported another security breach involving a compromised third-party provider.
On that occasion, malicious code was injected into the platform’s web interface.
The resulting theft was estimated at approximately US$3 million.
The recurrence highlights security challenges associated with integrating external technology into platforms handling digital assets.
Industry Impact and Next Steps
The incident raises further questions about cybersecurity across prediction market platforms.
Reliance on external suppliers, active-session permissions and the integrity of website components are important considerations when preventing fraudulent transactions.
Polymarket will continue processing reimbursements while investigating the technical circumstances of the attack.
With US$3.9 million allocated to compensation, 726 wallets directly affected and approximately 5,500 additional wallets covered by further payments, Polymarket is seeking to restore confidence following a cyberattack that exposed risks within prediction markets’ technology supply chains.
Edited by: @fonta
