Polymarket users lost an estimated $2.7 million in a suspected cyberattack linked to a breach at a third-party technology provider, prompting the prediction market to temporarily suspend trading on its international platform on Thursday. The company has since restored trading and pledged to fully reimburse users whose funds were taken.
The incident came to light after traders reported unauthorised withdrawals from their accounts. Polymarket said it had identified and fixed the vulnerability, adding that it had referred the matter to law enforcement in the United Kingdom, where DebugBear is based.
An official familiar with the investigation identified DebugBear, a UK-based website performance monitoring company, as the third-party provider involved, according to Wall Street Journal.
Polymarket initially halted trading on its international exchange, Polymarket.com, after detecting a security issue involving an external service provider.
Polymarket subsequently switched to a cancel-only setting, allowing users to withdraw existing orders but preventing them from placing new ones. Relayer operations, which facilitate transactions on the platform, were also suspended while the company investigated.