The prediction-markets platform says it will make affected traders whole and has notified law enforcement.
Polymarket has said that some users of its international exchange lost funds after hackers compromised an unnamed third-party provider. The company has notified law enforcement and committed to reimbursing every trader affected. It has not said how many users were hit, and its U.S. platform was unaffected.
The problem surfaced on Thursday afternoon, when traders posted on social media that money was leaving their wallets without their approval. Polymarket suspended trading on the international platform in response. It later said the issue had been fixed and that trading restarted at 3 p.m. ET.
On the question of repayment, Polymarket told users on Discord that anyone who lost less than $10,000 would be repaid by Oct. 30. Users who lost more than that must sign a release form before their funds are restored.
According to a person familiar with the matter, the breach originated at DebugBear, a company that monitors website performance. DebugBear confirmed on X that it had suffered a security incident on Thursday, though it did not immediately answer CNBC’s request for comment. The same source said Polymarket took the case to U.K. law enforcement, since DebugBear is based in Britain.
Two analytics firms, Betting Intelligence and Polysights, reviewed public data for CNBC. They found that an account on Polymarket withdrew at least $2.7 million across 710 other wallets on Thursday. Dan Zimmermann, chief intelligence officer at Betting Intelligence, called it “a significant and new form of breach” for the platform. He said its timing, ahead of the midterms, should serve as a “wake up call.”
The international exchange runs as a decentralised finance platform on the Polygon blockchain and is not regulated in the United States. The incident comes days before the U.S. midterm elections on Nov. 3, when trading on both the international and U.S. exchanges is expected to climb. Polymarket reported a similar episode in June, when it said a third-party vendor had been compromised and promised refunds to affected users.
