Polymarket halts trading after a hacked vendor drains about $2.7 million from users, months after a similar June breach

Polymarket halted trading on its international platform on Thursday after users reported funds disappearing from their accounts, in what the company said was a compromise of a third-party provider. The platform moved to cancel-only mode, so traders could cancel open orders but not place new ones, and paused relayer actions, which submit signed transactions to the blockchain.

The company did not name the vendor. Hudson Rock, a security firm, linked the attack to a script loaded from DebugBear, a web-performance service, according to Decrypt, and Finance Magnates, citing the Wall Street Journal, said DebugBear told customers to remove its embedded code. CoinDesk cited DeFiLlama tracking about $2.7 million in losses. Finance Magnates, citing the Journal's review of blockchain data, reported that a wallet believed to be the attacker's received more than $2.5 million through more than 900 transactions. Those are outside estimates; Polymarket had not published a total.

Polymarket said it had identified and fixed the issue, referred it to law enforcement and that affected users would be made whole. Reports said trading was expected to resume around 3 p.m. Eastern that day, though crypto.news did not confirm it had.

CoinDesk noted a similar breach in June, when a compromised vendor let attackers take about $3 million from users. It is another case of a hack arriving through a vendor rather than the platform's own code.