Polymarket Halts International Trading After DebugBear Breach Drains User Wallets

Key points

• Polymarket paused international trading around 1:30 p.m. ET after users reported unauthorized fund withdrawals from their wallets.
• The incident was traced to a security breach at DebugBear, a UK-based website performance monitoring tool used by Polymarket.
• Polymarket stated it would fully reimburse all affected traders and referred the matter to UK law enforcement.
• Trading resumed at 3:00 p.m. ET after the company fixed the issue on its end.
• The US platform was not compromised, and the incident occurred days before heightened trading volumes expected during the November 3 midterms.

Background

This incident follows a similar third-party vendor compromise in June 2026, where Polymarket also pledged to refund affected users. The platform has recently intensified surveillance of election-related bets, referring cases to the CFTC, amid concerns about market manipulation ahead of the 2026 midterms.

How outlets are covering it

The Guardian and The Washington Post emphasized the rapid user panic and the company's promise to 'make whole' affected traders. CNBC highlighted the specific mechanism of the hack, noting that traders first flagged unauthorized withdrawals on social media before the halt. Wired’s coverage was largely obscured by cookie consent text, offering no distinct analytical perspective. All sources agree that the breach originated from DebugBear, though only CNBC and The Washington Post explicitly named the vendor in their reporting. The Guardian noted the referral to UK law enforcement, while CNBC confirmed the international exchange operates on the Polygon blockchain and is unregulated in the US.

Why it matters

The incident exposes vulnerabilities in prediction market infrastructure reliant on third-party vendors, potentially undermining user trust ahead of high-stakes election betting. It also highlights the lack of regulatory oversight for international prediction markets, raising concerns about financial security and transparency in decentralized finance platforms.

What to watch

Polymarket will monitor for any further unauthorized activity and process reimbursements for affected users. DebugBear is expected to address the security incident and advise clients to remove its embed code. Regulators may scrutinize the incident as part of broader oversight of prediction markets ahead of the 2026 midterms.