Have Polymarket been hacked?

[greysonz]

Platform users are reporting on Discord that the Polymarket frontend has been hacked, allowing assets to be withdrawn from wallets without permission. Lots of posts from users in X.
There is no official confirmation of the hack yet.Until the circumstances are clarified, it is recommended to refrain from interacting with the platform.

If you are a Polymarket user, lock down your account. I just got drained $800,000
Other accounts are also affected. Friend got drained $600k

https://x.com/CarOnPolymarket/status/2115862718452298234?a=_YOub7swV75jY_3SnUo&s=19

Also:



Update:

[OmegaStarScream]

https://x.com/CarOnPolymarket/status/2115862718452298234

This is the only post I found on X claiming that so far (but no addresses has been posted). Not sure about discord.

The status page is also showing that they have stopped their prediction trading API while they investigate things, with no official announcements:

https://status.polymarket.com/

EDIT: It looks like this might be the attacker's address:

https://x.com/search?q=0x3f99139f1c5854bb628c2e576aaf638e99dffc18&src=typed_query
https://polygonscan.com/address/0x3f99139f1c5854bb628c2e576aaf638e99dffc18

EDIT 2: The funds have now been sent to three different addresses :

- (~1.6M $) https://polygonscan.com/address/0x5392587814Ce8c6af6789764f88e5e9AB0b9962C
- (~392k $) https://polygonscan.com/address/0xe4C4C39C1733e1C7c06B79f97ED442B68Df41EC6
- (~522k $) https://polygonscan.com/address/0xc91ee0574a14446DE200923729c349B9CAE19b60

EDIT 3: from the status page

Identified ·
October 29, 2026 at 7:37 PM
We have identified and fixed the issue impacting our international platform, Polymarket.com. One of our third party providers was compromised, and we have referred this to relevant law enforcement. Anyone who has been impacted will be made whole. Out of an abundance of caution, we have temporarily halted trading and are working to bring the platform back online.

[sergiorus]

If you are a Polymarket user, lock down your account. I just got drained $800,000
Other accounts are also affected. Friend got drained $600k

https://x.com/CarOnPolymarket/status/2115862718452298234?a=_YOub7swV75jY_3SnUo&s=19

The tweet has been deleted. Extremely shady stuff. Now they are posting some nonsense like "managed to save $700k of it by sending to a friend". (https://x.com/caronpolymarket/status/2115881859704078520)

I know they are a big polymarket-aligned influencer and have seen some of their tweets before but that's just ridiculous.

Not trying to say the hack wasn't real, but this person is trying to
farm engagement on it, imho.

[greysonz]

If you are a Polymarket user, lock down your account. I just got drained $800,000
Other accounts are also affected. Friend got drained $600k

https://x.com/CarOnPolymarket/status/2115862718452298234?a=_YOub7swV75jY_3SnUo&s=19

The tweet has been deleted. Extremely shady stuff. Now they are posting some nonsense like "managed to save $700k of it by sending to a friend". (https://x.com/caronpolymarket/status/2115881859704078520)

I know they are a big polymarket-aligned influencer and have seen some of their tweets before but that's just ridiculous.

Not trying to say the hack wasn't real, but this person is trying to
farm engagement on it, imho.

True, onchain activists tracked down that he transferred the crypto to himself. But apparently, the hack is still real, since there was an official statement about a third party.

A list of the most affected is published, and the hack cost is stated at $2.65 million. Let's take a closer look at how events unfold.

[Accardo]

Debugbear is a retard, the malicious guy went through this third party site, polymarket uses its RUM products to track user performance, injected a payload that steals user credentials, drains and sell position once they interact with Polymarket. Over $3 million has been swept from this attack at the moment. Here is the script launched from the debugbear nameserver: https://cdn.debugbear.com/C7xcKKrjUnXK.js

[salad daging]

Again and again the compromise is from a third party, as it is indeed the attack of many is the third party first. - https://x.com/PolymarketTrade/status/2115874609014726842

A list of the most affected is published, and the hack cost is stated at $2.65 million. Let's take a closer look at how events unfold.

Polymarket is solely responsible for lost funds, in which case compensation will be provided after the investigation is completed.
Very vulnerable.

[Karl_3000]

The way hacking is happening in crypto is something else. As we are discussing about this, we are discussing about others. I think this one has been overshadowed with the Binance hack and also is Trezor tampered wallet from CryptoBilis.

Those that are not logged in on Polymarket were not affected, but some of those that were locked in were affected. Hackers were able to compromise DebugBear which let them able to access users accounts that were logged in on Polymarket.