Over 700 international Polymarket accounts report stolen funds due to third-party hack

As a result of a third-party hack performed on October 29, over 700 international users of Polymarket’s financial exchange have reported stolen funds, totaling at least $2.7m in unauthorized withdrawals. 

The issue allegedly stemmed from a hack of DebugBear, which currently serves as a website performance monitoring platform. DebugBear also reported a security incident on October 29, but has not confirmed whether its platform was hacked at the time of writing. 

At 3pm PT, Polymarket confirmed the issue had been resolved, and trading resumed on its international financial exchange. The exchange operates as a decentralized finance platform on the Polygon blockchain and is not currently regulated in the US. 

Polymarket has since reported the incident to UK law enforcement and pledged to reimburse international users who were affected by the hack. Although the operator confirmed trading has resumed, neither it nor DebugBear has issued further comment on the hack up to this point. 

In June, a Polymarket third-party vendor was also the victim of a cyberattack, leading to a refund of approximately $3m to users affected by the hack. 

The attack represented the second reported by Polymarket within June alone, following a hack which cost the operator nearly $700,000 and was most likely the cause of a private key compromise.

While all lingering effects appear to have been resolved by Polymarket, the attacks are particularly notable with the US Midterm Elections set to begin on November 3. 

Both Kalshi and Polymarket announced new guardrails for player safety in the lead-up to the Midterm Elections, but also unveiled enhancements made to detect potential manipulation of their political markets.

Polymarket introduced election-specific surveillance systems designed to monitor manipulation attempts, although perhaps anti-cyberattack software would be a smart investment for the prediction market as well.