Polymarket Users Report Unauthorized Withdrawals After Third-Party Hack

Polymarket said Thursday that its international prediction market platform experienced an outage after a third-party data provider was hacked, and some users reported unauthorized withdrawals from their wallets. The company said it halted trading, fixed the issue, and pledged to reimburse affected traders. It also said it contacted law enforcement and that its U.S. platform was not compromised.

Unauthorized withdrawals and trading halt

Traders first reported on social media platforms that they were seeing unauthorized withdrawals from their accounts on Thursday afternoon. In response, the company halted trading on its international platform. Polymarket said that it has fixed the issue on its end, and that trading resumed at 3 p.m. ET. It told users later in a chatroom on Discord that users who had less than $10,000 taken from their wallets will have funds restored by Oct. 30, and those with funds greater than that figure withdrawn will have to sign a release form to receive their restoration. An analysis of publicly available data by two analytics firms, Betting Intelligence and Polysights, provided to CNBC said that an account on Polymarket Thursday withdrew at least $2.7 million across 710 other wallets. "This is certainly a significant and new form of breach that we've seen on Polymarket," said Dan Zimmermann, the chief intelligence officer at Betting Intelligence. "The timing right before the midterms ... is certainly a wake up call for folks."

Provider identified as DebugBear

A person familiar with the matter told CNBC that the issue stemmed from a hack of DebugBear, a website performance monitoring platform. DebugBear in a post on X said that it was impacted by a security incident on Thursday. The person familiar with the Polymarket outage said that the company referred the matter to U.K. law enforcement, as that is where DebugBear is based. DebugBear did not immediately respond to a request for comment.

Refunds, regulation and election timing

Polymarket said it has contacted law enforcement and pledged to reimburse any affected trader. It's unclear how many users were impacted. Polymarket's international prediction market exchange operates as a decentralized finance platform on the Polygon blockchain and is not regulated in the U.S. The disruption comes just days before both the company's international and U.S. exchanges are expected to see heightened volumes during the U.S. midterm elections on Nov. 3. Back in June, a similar incident happened, when Polymarket said a third party vendor had been "compromised" and that the company would refund affected users.

Sources: CNBC · NBC News · Unchained · Bitcoin.Com News