Polymarket Paused Trading After Hackers Stole about $2.7M and Michigan Ordered It to Exit the State

Polymarket says it temporarily halted trading after a third-party software compromise hit the platform on October 29 and affected hundreds of users. For high-risk operators, the useful detail is not the headline number alone: the incident shows how a web-layer compromise can turn into wallet drains without a phishing link or password leak.

1. Reports say hackers tampered with Polymarket.com’s JavaScript code and used a modified script hosted on DebugBear, a third-party performance monitor, to exploit existing logged-in sessions. In practice, that let them access customers’ wallets and either sell or transfer assets to attacker-controlled wallets.
2. Estimates of the damage vary. Blockchain analytics firm Bubblemaps said the attack affected 700 users on Polymarket’s international platform. Bitquery put the number of affected users at 737 and the stolen amount at $2.73 million, while BleepingComputer traced roughly $2.57 million in Polygon’s proprietary POL cryptocurrency from a suspected attacker’s wallet.
3. Polymarket has not confirmed how many customers were affected or how much was stolen, but it acknowledged the attack and said it would reimburse affected players. The company also canceled operations for an hour, then resumed trading and referred the incident to UK law enforcement.
4. DebugBear also acknowledged the incident and asked clients using its Real User Monitoring to remove the software’s embedded code from their websites to avoid further incidents. That is the bit PSPs and platforms usually learn the hard way: the compromised path does not need to be your payment stack to create a payments problem.
5. Separately, the Michigan Gaming Control Board said it ordered Polymarket to leave the market by November 25, 2026. That adds another regulator-driven constraint for a platform already dealing with operational and security issues.