Trading on Polymarket's flagship international platform stopped for several hours on October 29 after hackers drained funds from traders' wallets. By the time it restarted, the damage was already visible on X: prominent traders posting empty balances, and the blockchain analytics firm Bubblemaps estimating that roughly 700 users had lost about $2.7 million between them.
Polymarket's account of the incident points away from its own code. A third-party vendor based in the United Kingdom was compromised, the company said — not the prediction market's website. UK law enforcement has been notified. Polymarket declined to say how many traders were affected or how much was taken, but said it will make affected users whole.
The split between Polymarket's two products mattered here. Polymarket US, which operates as a federally regulated financial exchange inside the United States, was not affected. The platform that was drained is the cryptocurrency-based flagship, which is banned in the United States and a number of other countries — the venue most of the company's international volume runs through.
The second time in five months
The uncomfortable part is the pattern. In June 2026, Polymarket traders lost money in a breach that also began at a third-party vendor: a compromised supplier injected a malicious script into the frontend served to some users, and attackers used it to get those users to approve fraudulent transactions. The company put the losses at more than $2 million at the time; Bubblemaps and Cointelegraph put the figure nearer $2.9 million across fewer than 20 accounts. Polymarket said then that it had contained the compromise and removed the affected dependency.
Five months later, the same category of failure — a supplier inside the trust boundary, rather than the exchange's own contracts — has produced another halt, another set of drained wallets and another promise of refunds. Neither incident required breaking Polymarket's market mechanics. Both required only that a user's browser load something the platform had approved.
Why a refund does not close the question
Polymarket has never been short of scrutiny. It has been the centre of repeated alleged insider-trading cases — a special forces soldier accused of wagering on the capture of Venezuela's former leader, and a Google employee accused of using confidential information to make millions; both have pleaded not guilty. It raised $1 billion in August 2026 in a round led by 1789 Capital, the venture firm where Donald Trump Jr. is a partner, and is now valued at $21 billion.
That valuation rests on a specific claim: that a prediction market produces a trustworthy probability, and that the price is the product. A trader who is refunded after a breach is still a trader who watched a balance go to zero while the platform was, by its own description, investigating. Refunds restore money. They do not restore the assumption that the number on the screen is safe to act on, and they say nothing about the vendor management that has now failed twice.
What is still unknown
Polymarket has not named the UK vendor, described how the compromise worked, or said whether this incident shares the June mechanism. It has not said whether the two products — the US exchange and the international platform — share suppliers, which would turn a single vendor failure into a cross-market risk. And it has not said what, beyond a refund, changes in how third-party code reaches its frontend.
Until those answers exist, the honest reading is narrow: trading is back, some users were made whole, and a supply chain that has now broken twice has not been described in public.
