The predictive market platform that allows users to bet on real-world events has blamed the breach on a compromised third-party provider
Hackers have swiped at least $2.6 million in user funds from predictive market platform Polymarket that allows people to wager on real-world events, including elections and military action. The company was forced to briefly pause trading on its international exchange, promising to reimburse all affected users.
In an X post on Thursday, a Polymarket-related account said that the company had “identified & fixed an issue impacting our international platform.”
“We have temporarily halted trading,” the statement read, adding that the breach occurred after “one of our 3rd party providers was compromised.”
The hack only affected Polymarket’s flagship platform, although Polymarket US, which operates independently as a federally regulated financial exchange, was spared.
Several media outlets, including the Wall Street Journal, reported that the third-party provider that Polymarket referred to was DebugBear – a UK-based performance-monitoring platform.
DebugBear wrote on X on Thursday afternoon that it was “aware of a security incident,” advising clients using its RUM product to “remove the embed code from your website.”
According to Business Today, citing blockchain analytics firm Bubblemaps, as many as 700 Polymarket accounts were affected, with users reporting unauthorized withdrawals and sudden balance liquidations.
The breach coincided with a major cyberattack at Binance, the world’s largest cryptocurrency exchange, that saw intruders steal an estimated $6.3 billion.
As for Polymarket, it suffered another breach as recently as June, with hackers getting their hands on more than $2 million.
In recent years, Polymarket, along with its major rival, Kalshi, have been at the center of multiple scandals, involving insider trading by American officials and military personnel, with several US states also accusing them of sidestepping gambling laws.
Last week, the Associated Press reported that US Secretary of War Pete Hegseth had issued a directive specifically warning service members against using classified material to bet on prediction markets.
Earlier this year, US Army Green Beret Master Sgt. Gannon Ken Van Dyke was arrested and charged with illegally profiting from advance knowledge of the January operation to abduct Venezuelan President Nicolas Maduro.
Prosecutors alleged that the defendant had placed more than $32,500 in Polymarket bets, mostly on January 2, hours before the US attack on Caracas. Van Dyke allegedly raked in $400,000 by betting on Maduro’s removal from power.
The man pleaded not guilty.
Newly created Polymarket accounts also placed suspiciously timed bets shortly before US President Donald Trump announced an April US-Iran ceasefire, generating hundreds of thousands of dollars in profits. The White House subsequently warned staff against trading on confidential information.
In late August, Trump’s long-time teleprompter operator, Gabriel Perez, was ordered to pay $65,000 to settle a case related to his “unlawful” prediction-market trading about the president’s speeches.
The White House aide was also required to give up $107,000 in ill-gotten profits from his wagers on Kalshi, the Commodity Futures Trading Commission said at the time.
