Prediction market platform Polymarket temporarily suspended trading on its international platform after hackers drained more than $2.6 million from user accounts. The incident, reported on 29 October, affected more than 700 accounts, according to reports citing the Wall Street Journal and on-chain analysis.

Polymarket said a third-party service provider for its international platform had been compromised, that the issue had been identified and fixed, and that trading had resumed after a pause of about an hour. The company said it had referred the incident to law enforcement in the United Kingdom and promised to fully reimburse affected traders.

The breach has been linked in reports to DebugBear, a UK-based website performance monitoring company. DebugBear said on social media that it had been affected by an ongoing security incident and advised clients using one of its products to remove its embed code from their websites. Polymarket’s US platform was not affected.

How a vendor breach reached user accounts

The case is a reminder that a platform’s security is only as strong as the outside tools connected to it. A monitoring script or embed supplied by a vendor can sit inside a website’s pages, and if that supplier is compromised, the malicious code can reach visitors of every site that uses it.

Analysts tracking blockchain movements estimated that at least $2.7 million was withdrawn from around 710 wallets, with funds moving through a single account before being dispersed. The exact mechanism is still under investigation, and early reports have pointed to compromised relayer functions — the infrastructure that processes and validates user transactions — rather than to a flaw in Polymarket’s core market contracts.

What users should check

Polymarket has told affected users they will be made whole, and traders should follow only its official updates for reimbursement instructions. Users of any platform should be wary of messages asking them to sign documents, share identification, or click links after a breach, and should verify such requests through the platform’s own official channels first.

Sources: Crypto-Economy; Gizmodo.