Polymarket Hacked Again? Every Incident Since 2024, and Is Polymarket Safe Now

Yes, Polymarket was hacked again. On 29 October 2026 attackers took over the domain of DebugBear, a performance-monitoring service whose script ran on polymarket.com, and replaced that script with a drainer. Until Polymarket removed it shortly before 18:00 UTC, it used the open sessions of logged-in visitors to sell their positions and move the money out. Polymarket says $2.7 million was taken from 726 wallets. It has paid back $3.9 million, which includes $1.19 million for traders who lost money while trading was halted.

It was the second time in four months that code loaded by the website was turned against its users: in June a compromised vendor script took about $3 million. Counting from 2024, we found 12 security incidents that hit Polymarket users or Polymarket's own wallets, plus three disputed market resolutions that people often call hacks. In none of the thefts did attackers break the smart contracts that hold deposits and settle trades. They got in around them: through the sign-in provider, code on the website, an internal wallet key, fake sites and third-party bots.

Below are every incident with dates, amounts and sources, what happened on 29 October minute by minute, where the stolen money is now (we checked the attackers' wallets on 4 November), and which habits would have stopped which attack.

Current as of 4 November 2026, 11:00 UTC. Polymarket has not yet published its postmortem of the October incident. Figures differ between sources by 10–30%; we give Polymarket's own number first and the range after it.

Polymarket hack timeline: every incident from 2024 to 2026

Sources for each row are in the sections below. Two more claims circulate that we could not confirm: an alleged leak of 300,000 records (public profiles and wallet addresses, no emails, passwords or ID documents) posted by a user called "xorcat" in April 2026, and a separate fraud wave in September 2026 in which stolen debit cards were used to try to fund about $10 million of trades on the US app, as reported by the Wall Street Journal (Futurism). The second is payment fraud, not an account hack.

The pattern is clear from the chart. Until mid-2026 most losses came from users' side: shared login codes, fake sites, bots that hold keys. In 2026 the two largest thefts came from Polymarket's own website, through code it loaded from outside vendors.

Is Polymarket safe in 2026?

Polymarket's contracts have held up; the layers around them have not. The contracts that hold deposits and settle trades were audited between March and August 2026 by Cantina, Quantstamp, Certora, SigmaPrime, Zellic and Pashov, and a bug bounty runs through Cantina (Polymarket docs). No theft since 2024 came from a bug in them. The one contract-level problem, the February 2026 "ghost fills", let attackers cancel trades they were losing; it did not let anyone withdraw other people's money.

The risk sits in four places:

• —The website. Twice in 2026 a script loaded from an outside vendor ran on polymarket.com and stole from logged-in users. A bookmark does not protect you from this, because it was the real site.
• —The sign-in layer. Email and Google accounts depend on the provider that manages the wallet key behind them. Its flaws drained accounts in 2024 and 2025.
• —Your own device and habits. Fake sites, comment links and fake airdrops still work, and a shared 6-digit login code is a loss Polymarket says it cannot recover.
• —Third-party tools. Telegram bots and copy-trading scripts that ask for your private key have been drained or were built to steal.

Two more facts matter for anyone keeping a large balance there. Polymarket's documentation describes withdrawals as "instant and free", with no withdrawal delay or address allowlist (Polymarket docs). And we found no official help article about two-factor authentication inside a Polymarket account. So anyone who controls your session or your key can move everything in minutes; the protection is in how you sign in and how much you leave there.

Polymarket has paid users back when its own website was at fault (June and October 2026) and when it overrode a resolution it considered wrong (2024). It has not published refunds for login-provider takeovers, phishing or third-party bots.

What happened in the Polymarket DebugBear hack on October 29?

DebugBear sells "real user monitoring": a small script that measures how fast a site loads for real visitors. Polymarket ran it on polymarket.com. According to DebugBear, the attackers hijacked the DNS of the domain its script loads from and pointed it to their own server (SecurityWeek). Every site using the script started loading the attackers' file instead.

On Polymarket the swapped file checked whether the visitor was logged in. If not, it did nothing. If yes, it found the trading client that Polymarket's own page had already set up and used it (cside; ohey.ca):

• —Email and Google accounts got no prompt at all. The script placed sell orders for their positions at 97% of the price, then 50%, then the minimum price, and swept the cash (defiprime).
• —Accounts signed in with a browser wallet such as MetaMask saw a signature request labelled "DepositWallet" that moved their position tokens. Those who rejected it kept their positions.

The money went out through Polymarket's own transaction relayer to the attacker's address 0x3F99…Ffc18, so the traffic looked normal to the site's security rules. Researchers at Hudson Rock found no sign that seed phrases or private keys were copied (BleepingComputer).

The timeline, in UTC: the main burst of attacker transactions ran from 17:50 to 17:56; one analysis puts the first funds reaching the attacker at 17:10 (ohey.ca). At 17:59 Polymarket shipped a build that removed the DebugBear script, and at 18:05 it set the exchange to cancel-only and paused the relayer. Polymarket posted about it on X at 18:33, said it was fixed at 18:37 and closed the incident at 19:05 (BleepingComputer). The removal did not reach browsers that already had the page open, which is why closing tabs mattered.

How much was taken. Polymarket's figure is $2.7 million from 726 wallets (Bankless). Other counts range from $2.1 million (The Record, early) to about $3.1 million (AMLBot), and from 710 to 737 wallets. Most victims lost little: Bitquery puts the median loss at $171, while four accounts lost more than $100,000 each and together account for 43% of the total (via Bankless).

What Polymarket changed. It removed the script, reset every active login session, referred the case to law enforcement and promised integrity checks, version pinning, monitoring and a stricter content security policy for third-party code (cside). Security researcher Scott Helme pointed out that the site's policy allowed every domain the drainer used, and that pinning the script to a fixed hash would have blocked the swapped file (via Bankless).

We loaded polymarket.com ourselves on 4 November, logged out. The DebugBear script was gone from the page and from the site's content security policy. That policy now lets scripts load only from the site itself, the Intercom support chat, Vercel, Google sign-in, Cloudflare's bot check and a separate vendor.polymarket.com subdomain, and several analytics scripts are served from Polymarket's own domain under versioned file names. We could not see what loads after signing in.

Will Polymarket refund hacked users?

For October, yes, and automatically. Polymarket says it identified affected wallets from on-chain and trading data, so "no claims or tickets" are needed (The Record). By the morning of 30 October, 689 of the 726 wallets had been repaid in full (Bankless). About 5,500 more wallets were paid $1.19 million in total for losses during the halt or forced sales. Secondary reports say losses above $10,000 required signing a release and an ID check; Polymarket has not said so publicly.

Because no claim is needed, any email, DM or website asking you to "claim your Polymarket refund" is phishing.

The record for earlier incidents is mixed:

Sources: The Block, Cointelegraph, The Block, GIGAZINE, Polymarket Help.

The rule so far: Polymarket pays when its own site or a vendor it chose was at fault. When the loss starts on the user's side, there is no published refund policy.

Was my Polymarket account hacked? How to check

For the October incident you were at risk only if you were logged in with polymarket.com open in a browser tab on 29 October, in the hour or so before trading was halted at 18:05 UTC. Signs:

• —In your activity, sells you did not make at very low prices (orders at 97% or 50% of the price, or at the minimum), or transfers of positions to an address you don't know.
• —A refund credited to your balance after 30 October. Polymarket paid affected wallets without being asked.
• —If you use a browser wallet: a "DepositWallet" signature request you don't remember starting.

For any other suspicion, open your Polymarket wallet address (the deposit address shown in your account, not your MetaMask address) on Polygonscan and look for outgoing pUSD, USDC or position-token transfers you did not make. You can also see which contracts are allowed to spend from your Polymarket wallet with Polymarket's public endpoint `data-api.polymarket.com/v2/approvals?user=<your address>`. Only Polymarket's own exchange contracts should appear: 0xe3333700…6c00Aa, 0xE1111800…7B996B, 0xe2222d27…310F59 and the Neg Risk Adapter 0xd91E80cF…A35296 (Polymarket docs).

Where is the stolen money now? Our on-chain check

We looked up the attackers' addresses named by investigators on 4 November 2026 (Polygon block 96,721,132, Ethereum block 26,340,768).

• —October. The address found in the swapped script, 0x3F99139F…Ffc18, holds 0.025 POL and about $4,100 in USDC.e. Almost everything else has moved on: BleepingComputer saw about 28.6 million POL (around $2.57 million) sent on to three more wallets on the day of the attack.
• —June. Investigators traced the June theft to one Ethereum address, 0xe65b1C58…71E1eD, holding 1,892.92 ETH after the attacker bridged and swapped the stolen pUSD (cside). It was empty within about 30 hours of Polymarket's warning: 100 ETH left on 26 June at 07:08 UTC and 1,788.5 ETH at 20:49 UTC. The larger sum sat in a second wallet for three weeks, and on 18–21 July it was split into round amounts (700, 500, 200, four of about 100, and 70 ETH) across more than ten new addresses.

One detail from the June wallet shows how common address-poisoning scams are: after the theft, the attacker's own address received more than 40 tiny transfers from lookalike addresses, sent by bots hoping the thief would copy the wrong address by mistake.

None of this money has been reported as frozen. Unlike the stablecoins frozen after other hacks, POL and ETH cannot be blocked by an issuer, which may be why both attackers converted so quickly.

Is my money safe on Polymarket? Were the smart contracts hacked?

No deposits were stolen through a contract bug in any of the 12 incidents. That answers half the question. The other half is that your balance is only as safe as whatever can sign for your wallet, and in 2024–2026 that was attacked through the sign-in provider, the website and users' devices.

How the money is held: when you sign up, Polymarket creates a smart-contract wallet on Polygon for you. Since 4 May 2026 new accounts get a "Deposit Wallet"; older accounts have a Proxy wallet (email or Google sign-in) or a Safe (browser-wallet sign-in) (Polymarket docs). Each wallet is controlled by a signer key. For browser-wallet users that key is in their own wallet. For email users it is managed by an embedded-wallet provider, and you can export it at reveal.magic.link/polymarket while logged in (Polymarket Help). Collateral is pUSD, a USDC-backed token, not USDC.e as older guides say.

There is no deposit insurance on an on-chain prediction market, and Polymarket's refunds are a company decision, not an obligation.

The May 2026 theft is a useful contrast. Someone stole the key of an internal wallet Polymarket used for rewards and took $520,000 to $700,000 (SlowMist counts $573,000, of which $164,000 was frozen). Polymarket said "user funds and market resolution are safe", and no user losses were reported (ForkLog).

Email login or wallet: which Polymarket login is safer?

For a large balance, a browser wallet, ideally backed by a hardware wallet, has been safer in every incident so far. For a small balance, email login is simpler and the difference matters less.

• —December 2025 hit email-login accounts through the sign-in provider; wallet logins were not affected. One user reported losing about $2,000 even with two-factor authentication on their email (CoinDesk).
• —October 2026 drained email accounts without any prompt, while wallet users were asked to sign and could refuse.
• —June 2026 worked the other way: it needed a signature, so users who signed without reading lost money.

The trade-off: with a wallet login you keep the seed phrase, and losing it or leaking it is entirely on you. With email login the inbox is the key, so protect the email account with a strong unique password and an authenticator app or passkey.

How to protect your Polymarket account

No single habit covers every attack, as the chart shows. Together these cover all of the incidents above:

• —Open polymarket.com only from a bookmark or by typing it. Not from search ads, comment links, DMs or emails. Lookalike domains in 2025–2026 used odd endings (.cfd, .space), subdomain tricks (polymarket.com-v2…) and free hosting (pages.dev, github.io) (PhishDestroy).
• —Never give anyone your 6-digit login code, private key or seed phrase, including "support". Polymarket says it will never ask for your key.
• —Log out after trading and don't leave the site open in a tab. Both 2026 site attacks needed a logged-in session; after any incident news, close all tabs and reload.
• —Read every signature. A normal order is typed data from "Polymarket CTF Exchange" on chain 137 with a token, amounts and a side; creating API keys shows "ClobAuth" and the text "This message attests that I control the given wallet" (Polymarket docs). Reject anything you did not start, especially approvals to unknown addresses, "setApprovalForAll", permits, or batches that transfer tokens.
• —For a large balance, sign in with a wallet (ideally hardware) instead of email, so every signature is shown to you. Keep wallet security alerts on.
• —Secure the email or Google account you sign in with: unique password, authenticator app or passkey.
• —Keep only the money you are trading on Polymarket and withdraw the rest to a wallet you control. There is no withdrawal delay to stop an attacker.
• —Don't give your main key to Telegram bots, copy-trading tools or GitHub scripts. If you run a bot, use a separate wallet with a small balance and Polymarket's Session Keys where available: they can trade but cannot withdraw, and expire after 180 days (Polymarket docs). Our article on Polymarket trading bots covers how they work.
• —Check approvals now and then with Polymarket's approvals endpoint or revoke.cash on Polygon, and revoke unknown spenders. Revoking does not undo a transfer you already signed.
• —Treat "POLY airdrop", "claim your refund" and "V2 migration" messages as scams. As of 4 November 2026 Polymarket has no token; Bloomberg reported in October that a token is only being considered.
• —Export your key only through reveal.magic.link/polymarket opened yourself, store it offline and never paste it into a bot or site.
• —Contact support only through the chat icon on polymarket.com or support@polymarket.com (support@polymarket.us for the US app) (Polymarket Help).

Polymarket scams to watch for

• —Refund phishing. After the October incident, refunds were automatic, so every "claim" link is fake.
• —Links in market comments. In November 2025 scammers held both Yes and No shares so their comments stayed visible under "Holders", then posted links to a fake login that ended in a fake Cloudflare check. Its "copy" button put a malicious command on the clipboard (teiss).
• —Fake airdrops. The June 2026 "Community Rewards" page promised 250 million POLY and drained any wallet that connected to "check eligibility" (PCrisk).
• —Fake bots and SDKs. From January to July 2026 we counted at least nine waves of malicious "Polymarket" packages, including a hijacked GitHub organisation with more than 20 bot clones (StepSecurity) and a fake arbitrage bot that pulled 30 malicious npm packages (SafeDep). Install only the official clients from Polymarket's GitHub.
• —Search ads. In February 2026 a Polymarket trader lost a six-figure sum through a fake Uniswap ad on Google (Protos). The same trick works for any crypto site.

My Polymarket account was drained: what to do now

• —Close all polymarket.com tabs and log out, on every device.
• —Work out what happened. One asset gone points to an approval or a single signed transfer. Everything gone, across several tokens or chains, or new deposits vanishing at once, points to a stolen key or seed (revoke.cash guide).
• —If the key is compromised, stop using that wallet. Create a new one and move what is left. A compromised wallet cannot be made safe again.
• —Revoke the approval that was used, if there was one.
• —Write to Polymarket through the site chat or support@polymarket.com with your wallet address and transaction hashes.
• —Save evidence: transaction hashes, addresses, URLs and screenshots. Report to Chainabuse and the police (IC3 in the US).
• —Ignore anyone offering to recover your funds. They are almost always scammers too.

Should I withdraw my money from Polymarket?

You don't need to withdraw everything because of the October incident: the script is gone, sessions were reset and victims were paid back. But the incidents argue for a simple rule. Keep on Polymarket what you are actively trading and hold the rest in a wallet you control. With no withdrawal delay, an attacker who gets your session or key can take the whole balance in minutes, so the balance on the platform is your maximum loss.

Was Polymarket US affected?

No. The October attack hit the international site, polymarket.com. Polymarket US, the separate app regulated by the CFTC, was not affected (CNBC). The US app has its own accounts, identity checks and support address. The debit-card fraud wave reported by the Wall Street Journal in September 2026 concerned the US app.

Disputed resolutions: not hacks, but often called hacks

Some of the best-known Polymarket "scandals" were arguments about how a market was settled. Polymarket uses the UMA oracle: anyone can propose a result, anyone can dispute it, and UMA token holders vote.

• —June 2024, Barron Trump and the DJT token. UMA voters resolved "No"; Polymarket said UMA "got this resolution wrong", overrode it and refunded holders (The Block).
• —March 2025, Ukraine minerals deal. A market of about $7 million resolved "Yes" although no deal was signed. Users blamed a large UMA holder; Polymarket called it "unprecedented" but "not a market failure" and paid no refunds (The Block).
• —July 2025, Zelenskyy's suit. A market of over $237 million flipped to "No" after a dispute (Decrypt).
• —2026. A $16 million market on the streamer Clavicular went through two dispute rounds, and in July two traders sued Polymarket in New York over the "No" ruling on a market about Strategy selling bitcoin (Decrypt).

These are about market rules, not account security. Reading a market's resolution source before you trade is the protection here, as we explain in our report on insider trading and manipulation cases.

How we compiled this list

We searched Polymarket's statements on X, Discord and its help center, security research (BleepingComputer, cside, Hudson Rock, SlowMist, PeckShield, Bubblemaps, Elliptic), the OSV database of malicious packages, and crypto media from January 2024 to 4 November 2026. An event is included if Polymarket confirmed it, if on-chain investigators traced it, or if at least one security publication described specific losses. Weakly sourced cases are marked as such. Times of some posts on X were derived from the post IDs. Amounts are given as reported at the time; where sources disagree, Polymarket's own figure comes first.

Our own checks, done on 4 November 2026: balances and outgoing transactions of the attackers' addresses through public Polygon and Ethereum nodes and the Blockscout explorer, and the scripts and content security policy that polymarket.com served to a logged-out visitor.

What to do next

If you are new to prediction markets, our guide to how prediction markets work explains price, probability and payout. The habits above apply to any prediction market app, Melbo included. To trade prediction markets with your own funds, you can start on Melbo from $1.