Third-party glitch lets thieves sweep $2.7M from Polymarket users

Hackers moved at least $2.7 million from a single Polymarket account on Thursday afternoon. The funds were transferred across 710 other wallets. The theft affected users on the company's international exchange.

The breach originated at DebugBear, a website performance monitoring service. A person familiar with the situation said the Polymarket hack stemmed from a security incident at that third-party provider. DebugBear is based in the United Kingdom. Polymarket referred the matter to U.K. law enforcement.

Traders posted on social media about seeing unauthorized withdrawals from their accounts. The company stopped trading on its international platform in response. Polymarket said it fixed the issue and resumed trading at 3 p.m. ET.

The U.S. version of the platform was not compromised. The company pledged to reimburse any affected trader. It is not yet clear how many users lost money in the incident.

DebugBear did not immediately respond to a request for comment. Betting Intelligence and Polysights analyzed public data to estimate the total amount stolen. Their figures show the $2.7 million loss.

The outage occurred days before U.S. midterm elections on Nov. 3. Both Polymarket exchanges typically see higher trading volume during that period. A similar incident involving a compromised vendor occurred in June. Polymarket refunded users at that time.