# Polymarket Halts Trading Following Third-Party Vendor Security Breach A compromise at vendor DebugBear led to unauthorized user withdrawals on the prediction platform. - **Source:** [Gizmodo](https://gizmodo.com/) - **Published:** 2026-10-29 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/8d7da7cf-ccb2-4fdb-9311-d7a8818bbdec ## Unauthorized Platform Access Polymarket suspended trading operations on Thursday after hackers compromised its international exchange. The incident, which allowed unauthorized withdrawals from user accounts, was traced back to a security breach at DebugBear, a UK-based vendor providing web performance monitoring services. The platform quickly transitioned to a cancel-only mode to prevent further asset losses. ## Vendor Infrastructure Compromise The breach originated from DebugBear’s Real User Monitoring service, forcing the vendor to take its website offline. Polymarket confirmed that a third-party vendor was the entry point for the attack. Users were advised to remove relevant embed codes immediately, while Polymarket reported the criminal activity to law enforcement authorities by mid-afternoon. ## Financial Impact Analysis Data from the analytics platform Arkham suggests that attackers successfully siphoned approximately $2.65 million in tokens during the exploit. Despite the significant theft, Polymarket has publicly committed to reimbursing all affected customers. The exchange resolved the technical issue by 3:00 p.m. ET, though the full scope of the vulnerability remains under review. ## History of Security Incidents This event adds to a series of security challenges for Polymarket over the past year. Previous incidents include a $3.1 million phishing spree and a $520,000 theft involving contract infrastructure exploitation. Additionally, attackers previously attempted to hijack the resolution of a bet concerning mineral rights in Ukraine, highlighting persistent vulnerabilities in the platform. ## Regulatory and Political Context Polymarket and competitor Kalshi face intense scrutiny regarding their operations and regulatory standing. While Polymarket recently secured $1 billion in funding led by 1789 Capital, it remains under pressure. Congressional Democrats have signaled potential investigations into the platform, specifically questioning the influence of advisors like Donald Trump Jr. on federal regulatory approaches. ## Operational Scope Limitations The security incident specifically impacted Polymarket’s international crypto-based exchange rather than the federally regulated Polymarket US entity. This distinction is critical as the US-based platform currently faces legal challenges regarding state gambling laws. The incident highlights the operational risks inherent in relying on third-party vendors for critical web performance monitoring and infrastructure. ## Vendor Accountability Challenges Communication with DebugBear proved difficult following the breach, as emails bounced with DNS error messages and the company’s website remained inaccessible. This lack of transparency complicates the incident response process for affected clients. The situation underscores the systemic risks organizations face when third-party dependencies fail to maintain adequate security protocols for their services. ## Future Security Implications The breach serves as a stark reminder of the risks associated with third-party code integration in decentralized finance platforms. As prediction markets continue to attract significant capital, the necessity for robust vendor auditing and isolated infrastructure becomes paramount. Future regulatory oversight may focus heavily on these supply chain vulnerabilities to ensure better consumer protection. ## Sources covering this story - https://gizmodo.com/polymarket-temporarily-froze-trading-after-hackers-reportedly-stole-millions-via-third-party-service-2000832776 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._