Polymarket Users Lose $2.7 Million in Third-Party Hack

Unauthorized withdrawals totaling at least $2.7 million drained funds from Polymarket user accounts on Thursday.

Traders on the platform's international exchange discovered the missing money in the afternoon. The company immediately paused trading to stop further losses. Polymarket stated that it resolved the issue and restarted trading at 3 p.m. ET. The firm pledged to reimburse every affected trader.

The breach originated at DebugBear, a website performance monitoring service. A person familiar with the matter told CNBC that Polymarket referred the case to U.K. law enforcement because DebugBear is based in that country. DebugBear confirmed a security incident on its social media posts but did not immediately respond to comment requests.

Data from analytics firms Betting Intelligence and Polysights showed that one account withdrew funds from 710 other wallets. The company's U.S. platform remained secure during the event. The international exchange operates as a decentralized finance platform on the Polygon blockchain and is not regulated by U.S. authorities.

The disruption occurred days before the U.S. midterm elections on Nov. 3. Both the U.S. and international exchanges typically see higher trading volumes during that period. Polymarket experienced a similar third-party vendor compromise in June. The company refunded users in that earlier incident.

The U.K. investigation will determine how the hacker accessed the monitoring tool. Polymarket has not released a specific number of impacted accounts. The firm continues to monitor the situation as trading volume picks up ahead of the election.