Polymarket temporarily suspended trading on its international platform on Thursday after a third-party provider was compromised, allowing unauthorized withdrawals from some user accounts. The company confirmed the incident, referred the matter to law enforcement, and stated that impacted users would be fully compensated.

Users began reporting drained balances and unexpected position liquidations on social media early in the afternoon Eastern time. In response, Polymarket placed its exchange into cancel-only mode and paused relayer actions, which handle the submission of signed transactions to the blockchain. New orders and trades could not be processed while the investigation continued.

Scope of the Incident and Reported Losses

The disruption affected only Polymarket’s international venue, which operates as a wallet-based prediction market on the Polygon blockchain. The company’s separate U.S. platform, which functions under federal derivatives regulations, was not impacted.

Blockchain data and independent analysis indicated that funds totaling approximately $2.65 million to $2.7 million were transferred to a single wallet address. The assets largely consisted of POL, Polygon’s native token, received after swaps from bridged USDC through a cross-chain service. Activity began roughly an hour before the official status update and slowed after the platform restrictions took effect.

One trader publicly reported losing $800,000, with a friend losing an additional $600,000. Other social media accounts tracked the accumulation of funds in the suspected recipient wallet over a short window, peaking near the time the exchange entered restricted mode. Estimates of the number of affected accounts varied, with one analytics firm citing roughly 700 users.

Third-Party Vector and Company Response

Security researchers linked the compromise to a script hosted by DebugBear, a web performance monitoring service used by the platform. Analysis of the script showed code designed to detect authenticated trading sessions, sell positions, and direct assets to a hardcoded fallback address matching the wallet that received the bulk of the funds. Polymarket’s production code later showed the script had been removed.

The company identified DebugBear as the compromised third-party provider and referred the incident to U.K. law enforcement, the jurisdiction where the vendor is based. Polymarket stated it had contained the issue on its side and restored normal operations after roughly one hour of restricted trading. Full trading resumed later in the afternoon Eastern time.

This marks the second time in recent months that a third-party dependency has been exploited against the international platform. In June, a compromised vendor allowed malicious code into the frontend, resulting in losses estimated between $2.94 million and $3.1 million across a smaller number of accounts. Polymarket reimbursed those users in full at the time.

Platform Status and Next Steps

Polymarket’s status page classified the event as a major outage affecting its Predictions Trading API. Updates progressed from investigation to identification of the issue, confirmation of the third-party compromise, and eventual resolution. The company has not released an official tally of total losses or the precise number of affected accounts, nor has it published a detailed post-mortem timeline.

Traders were advised during the restriction period that existing orders could be canceled but no new activity would process. Relayer functionality remained offline until the platform was restored. Polymarket has reiterated its commitment to reimburse all verified losses stemming from the incident.