Polymarket confirmed that funds were stolen from users of its international exchange following a security breach at an unnamed third-party provider, identified by sources as DebugBear. The incident occurred on Thursday, prompting the prediction market platform to halt trading temporarily before resuming operations later that day. Polymarket stated it has refunded 95% of affected wallets and pledged to reimburse all impacted traders, totaling $3.9 million in restorations which includes $2.7 million in direct thefts and $1.2 million for losses incurred during the trading pause.
The breach stemmed from a hack of DebugBear, a website performance monitoring service based in the United Kingdom. Polymarket referred the matter to U.K. law enforcement authorities. While the company’s U.S. platform remained unaffected, analytics firms Betting Intelligence and Polysights reported that a single account withdrew at least $2.7 million across 710 other wallets. Users with less than $10,000 taken from their accounts will have funds restored by October 30, while those with larger withdrawals must sign a release form to receive reimbursement.
This disruption arises just days before the U.S. midterm elections on November 3, a period when Polymarket expects heightened trading volumes on both its international and domestic exchanges. This is not the first such incident; in June, Polymarket similarly refunded users after a third-party vendor was compromised. The international exchange operates as a decentralized finance platform on the Polygon blockchain and is not regulated in the U.S.
The reliance on third-party infrastructure introduces significant operational risk for decentralized platforms like Polymarket, particularly when those providers are located in jurisdictions distinct from the user base or regulatory oversight. By outsourcing critical functions such as performance monitoring to DebugBear, Polymarket exposed itself to supply-chain vulnerabilities that directly impacted end-user capital. The swift referral to U.K. authorities highlights the complex jurisdictional challenges inherent in global crypto-adjacent services, where technical breaches may require cross-border legal cooperation rather than simple internal remediation.
Timing exacerbates the reputational damage, occurring immediately prior to the U.S. midterm elections when prediction markets typically see peak activity. Although Polymarket committed to full reimbursement, the incident underscores the fragility of trust in unregulated international exchanges. Investors and traders must weigh the convenience of high-volume betting against the potential for non-custodial failures stemming from external vendor compromises, especially as these platforms prepare for periods of intense scrutiny and liquidity demand.
