Polymarket reopened its international exchange for trading on October 29, 2026, after a brief shutdown forced by a compromised third-party monitoring script. The platform stopped incoming orders, halted relayer activities, and promised customers their money back. The company's separate US platform was unaffected.

A monitoring script that reached into live trading sessions

Cybersecurity firm Hudson Rock uncovered a 15,187-byte malicious payload embedded in DebugBear's Real User Monitoring (RUM) script. RUM scripts are a common website-performance tool: site operators embed them so they run inside each visitor's browser and measure how pages load under real-world conditions. The code could access saved account information, identify authorized clients used by traders, and attempt to sell positions or transfer tokens.

Polymarket's website code subsequently showed that the DebugBear script had been removed, indicating the attack exploited code running on the website rather than a flaw in the platform's smart contracts. Hudson Rock published its findings in a report on its InfoStealers blog.

Cancel-only mode, then trading back by 3 p.m. ET

Polymarket placed the international exchange in cancel-only mode on October 29, 2026. Its status account said a provider had been compromised and that the case had been referred to U.K. law enforcement.

At approximately 3 p.m. ET that same day, trading began again on the exchange. The company also announced a refund policy. According to CNBC's report, customers who lost less than $10,000 are expected to receive their refunds by October 30, 2026. Customers who lost more than that amount must first sign a release form. Although Polymarket has communicated its refund plans, it has not confirmed that any refunds have been issued.

DebugBear told customers to pull its code

DebugBear also acknowledged the security problem. On October 29, 2026, the company urged customers to remove its monitoring code while specialist responders investigated.

We're impacted by an ongoing security incident. If you use our RUM product, please remove the embed code from your website. — DebugBear (@DebugBear) October 29, 2026

The warning highlighted a wider concern: third-party scripts can run inside legitimate websites, and if compromised, they may gain access to users' active browser sessions. Because the advisory covered any website running the RUM embed, it also underscored how a single compromised vendor script can expose many unrelated sites at once.

Preliminary loss estimates versus confirmed losses

The financial damage remains unclear for now. Betting Intelligence and Polysights traced at least $2.7 million in withdrawals involving 710 wallets on October 29, 2026, CNBC reported. Meanwhile, Hudson Rock identified about $2.19 million at a fallback recipient address, though that balance does not establish how much was stolen. Polymarket has yet to confirm the total losses.

Two earlier vendor failures, no shared cause

This was not Polymarket's first vendor-related security problem. In June 2026, Halborn and TechCrunch reported a malicious-script attack that reportedly drained around $3 million from at least 11 wallets. Polymarket promised refunds then, too.

Earlier, in December 2025, a separate authentication-provider breach affected users' accounts. Both Cryptopolitan and CertiK documented the incident.

All three cases involved outside providers. However, there is no evidence linking them to the same attacker or underlying cause.

What repeated vendor exposure means for the sector

The repeated incidents come as prediction markets attract more trading activity. An Artemis-derived report recorded $76.46 billion in trading volume across tracked markets in September 2026, with Polymarket accounting for $13.12 billion. These figures represent trading activity, not assets held.

That growth brings security concerns into sharper focus. CertiK warns that platforms combining traditional web services with blockchain technology can still have centralized vulnerabilities. Such risks could also discourage institutional investors. According to Jefferies, hedge funds are showing interest but remain cautious, with liquidity, compliance and reputational concerns continuing to hold them back.

Meanwhile, KPMG highlights the different responsibilities of vendors, brokers, exchanges and clearinghouses. U.S.-regulated exchanges must meet surveillance, system-safeguard and participant-protection requirements. However, those rules do not automatically apply to Polymarket International.

For Polymarket, restoring trading is only part of the challenge. The bigger test is whether it can manage risks from outside providers and regain users' confidence. Near-term markers include whether refunds under $10,000 arrive by the announced October 30 date, how the release-form process for larger claims unfolds, whether the company confirms a total loss figure, and what the U.K. law-enforcement referral and the ongoing investigations produce.