The Polymarket hack on 29 October 2026 came through a script from an outside vendor that ran inside the Polymarket website, sold or moved positions from logged-in accounts, and sent the proceeds to an attacker's address. Polymarket says everyone affected "will be made whole," so if you lost money, the claim to watch is the one Polymarket runs through its own channels. The wider lesson is about where you keep money you aren't using: anything sitting in an account that a website can act on is only as safe as every piece of code that website loads.
This is a developing story. The details below are what was confirmed or credibly reported by the evening of 29 October, and we'll update the figures as Polymarket publishes its own.
What happened in the Polymarket hack
Polymarket's status page shows the exchange switched to cancel-only mode at 18:05 UTC, with relayer actions (the service that submits users' signed transactions to the blockchain) paused. At 18:37 UTC the company posted that "one of our third party providers was compromised," that the matter had gone to law enforcement, and that affected users would be made whole. The incident was marked resolved at 19:05 UTC, and trading resumed around 3 p.m. Eastern after close to an hour offline, NBC News reported.
Polymarket hasn't named the provider. A person familiar with the matter told NBC News it was DebugBear, a website performance monitoring tool, and DebugBear itself posted on X about an "ongoing security incident" that afternoon. The incident hit the international site at polymarket.com, while Polymarket's US platform didn't appear to be affected. Polymarket also said the attack appeared to come from the United Kingdom and that it had referred it to British law enforcement.
How the script took the money
Researchers at Hudson Rock published a static analysis of the malicious script, which was served from a DebugBear address that Polymarket's pages loaded. The code read three pieces of information the Polymarket site keeps in your browser (your login context, your deposit wallet address and your trading API credentials), then found the site's own trading tools and used them.
What it did next depended on how you signed up. For accounts created with an email login, it placed sell orders at steadily worse prices to turn positions into cash and then tried to transfer the proceeds out. For accounts connected with an external wallet, it built a batch transfer of position tokens straight to the attacker. In both cases it reused authority the site already had, so it didn't need to steal a password or a seed phrase. Hudson Rock is careful to say that it analysed the code without running it, so the analysis shows what the script was built to do and stops short of proving every step succeeded or whether a signing prompt appeared for wallet users.
Polymarket's production code shows a change titled "remove debugbear rum script" built at 17:59 UTC, a few minutes before the trading halt.
How much was lost
Polymarket hasn't published a total. Blockchain analytics firm Arkham flagged a suspected attacker address holding about 2.65 million USD in POL, Polygon's native token, after a run of swaps from bridged USDC, Decrypt reported. Hudson Rock found that same address hard-coded in the script as its fallback recipient and saw roughly 2.19 million USD there in a screenshot, while noting that a balance isn't a verified count of stolen funds. Figures from individual traders on social media run into the hundreds of thousands per account, but none of them have been confirmed.
The third Polymarket incident of 2026
This is Polymarket's third security incident of 2026. In May, a compromised private key drained about 700,000 USD from an internal top-up wallet, according to Decrypt. In June, another compromised vendor let attackers slip malicious code into the website and take about 3 million USD from fewer than 15 accounts, and Polymarket promised full refunds then too.
The June and October cases share a shape. Neither required breaking Polymarket's smart contracts; instead, someone got code into the pages users were already logged into, and the code did what a logged-in user is allowed to do.
Is Polymarket safe to use now?
Polymarket says it found and fixed the problem, and trading is back. That's a fair basis for continuing to trade if you want to, with two caveats. First, a fix in one build doesn't clean up a tab that loaded the old script, so close any Polymarket tabs left open from 29 October, log out and sign in again. Second, a site that loads outside scripts can be hit again the same way, and this one has been hit twice in five months.
If you were affected, Polymarket hasn't yet said how claims will be checked or when payments will arrive. Watch Polymarket's own X accounts and status page for that process, and ignore any message, form or support agent that reaches out to you first offering a refund, because fake recovery offers follow every incident like this one.
The practical move is to treat a Polymarket balance the way you'd treat cash in a betting account. Keep on the platform what you're trading in the near term, and move what you aren't using somewhere a website can't reach.
Would a hardware wallet have stopped it?
For accounts created with an email login, a hardware wallet was never part of the setup. Those accounts sign through a key that Polymarket's login provider handles in the browser, and the script used that same machinery, so there was no separate device that had to approve anything.
For accounts connected to an external wallet, the script still had to ask that wallet to sign. A hardware wallet adds a step where you approve each signature on the device, which gives you a chance to refuse a request you didn't start. That chance depends on the details: the requests here were structured messages, which many wallets show as hard-to-read data, and Hudson Rock didn't confirm whether users saw a prompt at all. A hardware wallet on a betting site lowers some risk and leaves plenty in place.
We should be clear about our own product here. Ryder One can't sign for browser extensions such as MetaMask or Rabby, so it can't be used to trade on Polymarket. Where it fits is the other half of the advice above: the crypto you're holding for the long term, which you keep in self-custody on a device that shows you each transaction on its own screen and has no connection to any website.
What to take from it
Money in a hot wallet or a platform account works well for something you're actively doing, whether that's a trade, a bet or a swap, and every site you're logged into is part of its security. Your savings don't need that exposure. If you've been keeping long-term crypto on an exchange or an app account and this incident has you rethinking it, our checklist on your first hardware wallet covers what to compare, and our guide on moving crypto from Coinbase to a cold wallet walks through the transfer itself.
Share: