Have Polymarket been hacked?

[greysonz]

Platform users are reporting on Discord that the Polymarket frontend has been hacked, allowing assets to be withdrawn from wallets without permission. Lots of posts from users in X.
There is no official confirmation of the hack yet.Until the circumstances are clarified, it is recommended to refrain from interacting with the platform.

If you are a Polymarket user, lock down your account. I just got drained $800,000
Other accounts are also affected. Friend got drained $600k

https://x.com/CarOnPolymarket/status/2115862718452298234?a=_YOub7swV75jY_3SnUo&s=19

Also:



Update:

[OmegaStarScream]

https://x.com/CarOnPolymarket/status/2115862718452298234

This is the only post I found on X claiming that so far (but no addresses has been posted). Not sure about discord.

The status page is also showing that they have stopped their prediction trading API while they investigate things, with no official announcements:

https://status.polymarket.com/

EDIT: It looks like this might be the attacker's address:

https://x.com/search?q=0x3f99139f1c5854bb628c2e576aaf638e99dffc18&src=typed_query
https://polygonscan.com/address/0x3f99139f1c5854bb628c2e576aaf638e99dffc18

EDIT 2: The funds have now been sent to three different addresses :

- (~1.6M $) https://polygonscan.com/address/0x5392587814Ce8c6af6789764f88e5e9AB0b9962C
- (~392k $) https://polygonscan.com/address/0xe4C4C39C1733e1C7c06B79f97ED442B68Df41EC6
- (~522k $) https://polygonscan.com/address/0xc91ee0574a14446DE200923729c349B9CAE19b60

EDIT 3: from the status page

Identified ·
October 29, 2026 at 7:37 PM
We have identified and fixed the issue impacting our international platform, Polymarket.com. One of our third party providers was compromised, and we have referred this to relevant law enforcement. Anyone who has been impacted will be made whole. Out of an abundance of caution, we have temporarily halted trading and are working to bring the platform back online.

[sergiorus]

If you are a Polymarket user, lock down your account. I just got drained $800,000
Other accounts are also affected. Friend got drained $600k

https://x.com/CarOnPolymarket/status/2115862718452298234?a=_YOub7swV75jY_3SnUo&s=19

The tweet has been deleted. Extremely shady stuff. Now they are posting some nonsense like "managed to save $700k of it by sending to a friend". (https://x.com/caronpolymarket/status/2115881859704078520)

I know they are a big polymarket-aligned influencer and have seen some of their tweets before but that's just ridiculous.

Not trying to say the hack wasn't real, but this person is trying to
farm engagement on it, imho.

[greysonz]

If you are a Polymarket user, lock down your account. I just got drained $800,000
Other accounts are also affected. Friend got drained $600k

https://x.com/CarOnPolymarket/status/2115862718452298234?a=_YOub7swV75jY_3SnUo&s=19

The tweet has been deleted. Extremely shady stuff. Now they are posting some nonsense like "managed to save $700k of it by sending to a friend". (https://x.com/caronpolymarket/status/2115881859704078520)

I know they are a big polymarket-aligned influencer and have seen some of their tweets before but that's just ridiculous.

Not trying to say the hack wasn't real, but this person is trying to
farm engagement on it, imho.

True, onchain activists tracked down that he transferred the crypto to himself. But apparently, the hack is still real, since there was an official statement about a third party.

A list of the most affected is published, and the hack cost is stated at $2.65 million. Let's take a closer look at how events unfold.

[Accardo]

Debugbear is a retard, the malicious guy went through this third party site, polymarket uses its RUM products to track user performance, injected a payload that steals user credentials, drains and sell position once they interact with Polymarket. Over $3 million has been swept from this attack at the moment. Here is the script launched from the debugbear nameserver: https://cdn.debugbear.com/C7xcKKrjUnXK.js

[salad daging]

Again and again the compromise is from a third party, as it is indeed the attack of many is the third party first. - https://x.com/PolymarketTrade/status/2115874609014726842

A list of the most affected is published, and the hack cost is stated at $2.65 million. Let's take a closer look at how events unfold.

Polymarket is solely responsible for lost funds, in which case compensation will be provided after the investigation is completed.
Very vulnerable.

[Karl_3000]

The way hacking is happening in crypto is something else. As we are discussing about this, we are discussing about others. I think this one has been overshadowed with the Binance hack and also is Trezor tampered wallet from CryptoBilis.

Those that are not logged in on Polymarket were not affected, but some of those that were locked in were affected. Hackers were able to compromise DebugBear which let them able to access users accounts that were logged in on Polymarket.

[logfiles]

The way hacking is happening in crypto is something else. As we are discussing about this, we are discussing about others. I think this one has been overshadowed with the Binance hack

You are right. I had missed out this incident because of the Binance hack and also some data breach news regarding coinbase and Bithumb until I saw philipma1957's post today

Hackers are becoming sharper lately and it appears like the AI tools are making their job easier and quicker.
I wish we would have a website that tracks these hacks and also has statistics to show whether the number of hacks has been growing over the past few years or not.

[mikel_012]

Debugbear is a retard, the malicious guy went through this third party site, polymarket uses its RUM products to track user performance, injected a payload that steals user credentials, drains and sell position once they interact with Polymarket. Over $3 million has been swept from this attack at the moment. Here is the script launched from the debugbear nameserver: https://cdn.debugbear.com/C7xcKKrjUnXK.js

This is the problem when you use a third party vendor

What they did was allow debugbear of anyone with access to the debugbear cdn to run any javascript in the site

In security you have one of the biggest problems which is XSS:

Cross-site scripting (XSS) is a web application security vulnerability that lets attackers inject malicious client-side scripts (usually JavaScript) into trusted websites.

Source: https://www.fortinet.com/uk/resources/cyberglossary/cross-site-scripting

And here they allowed this to happen with no vulnerability to the code

[philipma1957]

yeah looks like AI will be a hackers tool for sure.

also the trezor compromise is a big deal

I have a T-5 off line and I am afraid to set it back on line for now

[Synchronice]

Wait guys, didn't Polymarket's frontend got hacked recently too? Just a few months ago? And that previous attack was through compromised third-party javascript. This is a serious engineering red flag.

The way hacking is happening in crypto is something else. As we are discussing about this, we are discussing about others. I think this one has been overshadowed with the Binance hack and also is Trezor tampered wallet from CryptoBilis.

Those that are not logged in on Polymarket were not affected, but some of those that were locked in were affected. Hackers were able to compromise DebugBear which let them able to access users accounts that were logged in on Polymarket.

Yes, there is a wave of hacks, scams and other malicious activities in crypto world, including hardware wallets, exchanges, casinos and so on. I don't remember so many bad things happening in a row. They have an inadequate security controls around the frontend and they should prioritize strengthening the security, so there will be necessity of less refunds in the future. I feel like cyber security can be a great career today if you are good at it.

[Accardo]

Just in: Polymarket is demanding that affected users sign an NDA before getting a reimbursement for their lost money. The initial agreement while the hack was ongoing has drifted to a not looking good settlement agreement, polymarket at first said; every affected user would get reimbursed in whole, now they want users to sign a legally binding liability waiver and settlement contract before being eligible for the refund. Aside the KYC requirement, Polymarket is demanding that before a user receives the refund, they must sign an agreement that they won't sue the company for the inconveniences the data breach and stolen money must have caused them, and as well sign never to disclose this document to the public. Lame.