Polymarket to Fully Reimburse Affected Traders After Provider Compromise

Polymarket temporarily halted trading on its international platform, Polymarket.com, on October 29, 2026, after one of its third-party providers was compromised, according to the company’s incident record and statements posted to its Polymarket Traders account on X. Trading was restored one hour later, and the company pledged to fully reimburse all affected traders.

The exchange was placed in cancel-only mode and relayer actions were paused beginning at 2:05 p.m. Eastern Time, and the incident was marked resolved at 3:05 p.m. Polymarket said on X at 19:00 UTC: “Trading is now fully back online. We’ll make this right and are fully reimbursing all affected traders.” The company said it had referred the incident to relevant law enforcement.

One-Hour Major Outage on Polymarket.com

Polymarket’s status page opened the incident at 2:05 p.m. Eastern Time with an investigating notice stating that the exchange was in cancel-only mode and that relayer actions were paused. At 2:37 p.m., the company marked the issue identified. In that update, Polymarket said it had identified and fixed the issue impacting its international platform, Polymarket.com, that one of its third-party providers had been compromised, and that it had referred the matter to relevant law enforcement. The update said anyone who had been impacted would be made whole, and that trading had been temporarily halted as a precaution while the company worked to bring the platform back online.

At 2:55 p.m., the status moved to monitoring, with Polymarket stating that trading would resume at approximately 3 p.m. Eastern Time. The incident was marked resolved at 3:05 p.m. The record classifies the incident as a resolved major outage lasting one hour and lists the affected components as Predictions and Predictions Trading API, each with a major outage from 2:05 p.m. to 3:05 p.m. The status page prints incident times alongside a GMT-4 designation, while Polymarket’s posts refer to Eastern Time.

Polymarket’s first statement on X came at 18:33 UTC through its Polymarket Traders account, carrying the same message as the status update: the issue had been identified and fixed, one of its third-party providers had been compromised, the matter had been referred to law enforcement, anyone impacted would be made whole, and trading had been temporarily halted. At 18:54 UTC, the account posted that the platform was coming back online and that trading would resume at approximately 3 p.m. Eastern Time. The final post, at 19:00 UTC, said trading was fully back online and that the company was fully reimbursing all affected traders, restating the earlier made-whole pledge as an explicit reimbursement commitment. None of Polymarket’s status updates or X posts state how much was taken or how many accounts were affected.

Unnamed Provider and Prior Vendor Incident

Polymarket did not name the compromised third-party provider in its status updates or its X posts. At 18:00 UTC on October 29, shortly before the halt began, DebugBear posted on X: “We’re impacted by an ongoing security incident. If you use our RUM product, please remove the embed code from your website.” The post instructs users of DebugBear’s RUM product to remove its embed code from their websites. It does not name any customer, and Polymarket’s records do not identify the provider. The DebugBear post appeared before Polymarket’s first X statement on the incident.

The halt follows a separate third-party vendor compromise Polymarket disclosed earlier in 2026. In a post dated June 25, 2026, the company said it had discovered that morning that a third-party vendor had been compromised, injecting a malicious script into its frontend for some users. Polymarket said it had contained the issue and removed the affected dependency, and that it was contacting impacted users and refunding them in full.

For the October 29 incident, Polymarket’s stated next steps are the full reimbursement of affected traders and the referral to relevant law enforcement. The company’s status page shows the incident resolved as of 3:05 p.m. Eastern Time, with trading fully back online on Polymarket.com, the platform Polymarket describes in its statements as its international platform.