Polymarket says some users had funds stolen from its international exchange in hack
The prediction market halted trading after users reported unauthorized withdrawals, pledged refunds and said its U.S. platform was not compromised.
At a glance
- Polymarket says some users of its international exchange lost funds after a hack of an unnamed third-party provider; the U.S. platform was not affected.
- The company halted trading on the international platform and later said trading resumed at 3 p.m. ET after the issue was fixed.
- A person familiar with the matter told CNBC the hack involved website monitoring platform DebugBear, and the matter was referred to U.K. law enforcement.
Some users of Polymarket's international prediction market exchange had funds stolen from their accounts after a hack of an unnamed third-party provider, and the company has referred the matter to U.K. law enforcement.
Polymarket said it has contacted law enforcement and pledged to reimburse any affected trader. It is unclear how many users were impacted. The company's U.S. platform was not compromised.
Trading halted, then resumed
Traders first reported on social media that they were seeing unauthorized withdrawals from their accounts on Thursday afternoon. In response, Polymarket halted trading on its international platform. The company said it fixed the issue on its end and that trading resumed at 3 p.m. ET.
In a chatroom on Discord, Polymarket told users that those who had less than $10,000 taken from their wallets will have funds restored by Oct. 30, while users who had more than that amount withdrawn will have to sign a release form to receive their restoration.
Third-party provider blamed
A person familiar with the matter told CNBC that the issue stemmed from a hack of DebugBear, a website performance monitoring platform. DebugBear said in a post on X that it was impacted by a security incident on Thursday. The person said Polymarket referred the matter to U.K. law enforcement because that is where DebugBear is based. DebugBear did not immediately respond to a request for comment.
An analysis of publicly available data by two analytics firms, Betting Intelligence and Polysights, provided to CNBC, said an account on Polymarket withdrew at least $2.7 million across 710 other wallets on Thursday.
"This is certainly a significant and new form of breach that we've seen on Polymarket," said Dan Zimmermann, chief intelligence officer at Betting Intelligence. "The timing right before the midterms ... is certainly a wake up call for folks."
Days before the midterms
Polymarket's international exchange operates as a decentralized finance platform on the Polygon blockchain and is not regulated in the U.S. The disruption came days before both the company's international and U.S. exchanges were expected to see heightened volumes during the U.S. midterm elections on Nov. 3.
In June, a similar incident occurred when Polymarket said a third-party vendor had been "compromised" and that the company would refund affected users.
CNBC disclosed that it and Kalshi have a commercial relationship that includes customer acquisition and a minority investment.
Source: CNBC.
Questions and answers
- What happened to Polymarket users' funds?
- Some users of Polymarket's international exchange saw unauthorized withdrawals from their accounts after a hack of a third-party provider. Polymarket pledged to reimburse affected traders, though it has not said how many were impacted.
- Was the Polymarket hack linked to DebugBear?
- A person familiar with the matter told CNBC the issue stemmed from a hack of DebugBear, a website performance monitoring platform, which said on X that it was hit by a security incident on Thursday.
- Will Polymarket users get their money back?
- Polymarket said users who had less than $10,000 taken will have funds restored by Oct. 30. Those with more than that withdrawn must sign a release form to receive their restoration.
