Polymarket Suffers $2.7M Breach via Compromised JavaScript; Trading Halted

Polymarket, a major crypto-based prediction market platform, experienced a significant security breach on October 29, 2026, affecting hundreds of user accounts and resulting in losses estimated between $2.57 million and $2.73 million according to various blockchain analytics firms tracking the incident.

The attack exploited a vulnerability in third-party code integrated into Polymarket's website infrastructure. Hackers tampered with JavaScript linked to DebugBear, a performance monitoring service, allowing them to compromise active user sessions without requiring credential theft or phishing tactics. The modified code enabled attackers to access logged-in users' cryptocurrency wallets, executing transfers and sales of assets to attacker-controlled addresses without user initiation or awareness.

Blockchain firms provided varying damage assessments. Bubblemaps reported approximately 700 affected users on the international Polymarket.com platform, while Bitquery documented 737 affected accounts with $2.73 million in total losses. Cybersecurity firm BleepingComputer independently traced $2.57 million in Polygon's POL cryptocurrency moved from suspected attacker wallets. Notably, Polymarket itself has not publicly confirmed the exact number of affected customers or total stolen funds, though the company acknowledged the attack and committed to reimbursing impacted users.

The breach forced Polymarket to temporarily halt trading operations for approximately one hour while the company implemented remediation measures. Following the incident, Polymarket referred the matter to UK law enforcement authorities. DebugBear similarly acknowledged the security event and advised all clients using its Real User Monitoring service to immediately remove the embedded monitoring code from their websites to prevent similar exploitation vectors.

This incident highlights growing security challenges within the prediction markets sector, particularly as these platforms handle substantial cryptocurrency assets and integrate third-party services. The reliance on external monitoring and analytical tools introduces supply-chain security risks that traditional regulated gaming operators have long managed through compliance frameworks. The attack's sophistication - avoiding password compromise and phishing entirely - represents an advanced threat vector that could concern both users and regulators.

The timing compounds existing regulatory pressures on Polymarket. Concurrent with the breach disclosure, Michigan's Gaming Control Board ordered Polymarket to cease operations within the state by November 25, 2026, marking another significant regulatory defeat for the prediction markets sector. This enforcement action reflects broader state-level resistance to prediction market expansion, particularly around event contracts and perceived insider trading risks that U.S. regulators have increasingly highlighted throughout 2026.

Polymarket's pledge to reimburse affected users signals the platform recognizes its liability exposure and seeks to maintain user confidence amid mounting operational and regulatory headwinds. However, the incident underscores why prediction market platforms - currently operating in significant regulatory gray zones across most U.S. jurisdictions - face heightened scrutiny from both financial regulators and state gaming authorities seeking to constrain their market reach.