Polymarket halts trading after third-party software compromise; wallets reportedly drained

What happened

Polymarket halted trading on its international platform for nearly an hour on Thursday after a compromise at one of its third-party software providers, according to NBC News. The company said it had identified and fixed the issue, paused trading as a precaution, and referred the matter to the relevant law enforcement agencies. Service on Polymarket.com resumed at 3 p.m. ET.

Users on the platform's Discord channel reported that their wallets had been drained, though Polymarket did not confirm that anyone lost money. In posts on X, the company pledged to fully reimburse all affected traders. The U.S. version of the platform was not affected, NBC News reported.

The third-party entry point

The attackers reached user funds through software from DebugBear, a web analytics and website performance tool, according to a person familiar with the details who spoke to NBC News on condition of anonymity. DebugBear said on X at around 2 p.m. ET the same day that it was dealing with an ongoing security incident.

NBC News notes that compromising outside vendors has become a routine technique for attackers seeking access to large platforms and websites. What makes this incident notable is that money appears to have been taken directly from users rather than data simply being exposed.

Reported losses

The Block, citing data from blockchain analysis group Arkham, reported that roughly $2.65 million in cryptocurrency was siphoned out of Polymarket users' wallets. A Polymarket representative declined to comment on that figure or on the precise mechanics of the attack, and the company has not confirmed the wallet-draining reports from its community.

Polymarket said the attack appeared to originate from the United Kingdom and that it had referred the case to British law enforcement authorities.

A platform already under scrutiny

The breach lands on a company operating under heavy attention. NBC News reports that Polymarket processes about $200 million in trading activity per day and was valued at $21 billion in September, after a group of investors led by Donald Trump Jr. put $1 billion into the platform.

Polymarket and its rival Kalshi are also at the center of a multimillion-dollar dispute between U.S. states and the Trump administration over which side gets to regulate prediction-market betting. Separately, the platforms have been contending with suspected insider trading. Bloomberg News reported that Polymarket is investigating suspicious bets made during Israel's closely watched elections, and Shana Bautista, the company's head of global intelligence and investigations, said it is examining dozens of wagers tied to the U.S. midterms. Kalshi, for its part, said earlier this month that it is looking into suspicious bets connected to Trump's choice for press secretary.

Why it matters

The incident shows how a single analytics vendor can become a direct financial liability for every site that embeds it. When the compromised third party sits inside a crypto platform, the blast radius can extend to users' funds rather than ending at stolen data — which is why this plays out as drained wallets and reimbursements instead of a routine data-breach notification.

For Polymarket, the timing is particularly awkward: a company valued at $21 billion and handling roughly $200 million in daily volume is now simultaneously managing a wallet-draining breach, a referral to UK police, and multiple insider-trading investigations. Whether the promise to reimburse affected traders is fully kept, and what DebugBear's eventual post-mortem reveals about how its software was hijacked, will shape how much trust users place in the platform and in the third-party tooling that powers large parts of the web.