Polymarket Hack Drains Estimated $2.7M From Hundreds of Traders

Hackers drained an estimated $2.7 million from more than 700 accounts on Polymarket's international crypto exchange on Thursday, Oct. 29, 2026, after tampering with a third-party script. The Polymarket hack hit a prediction market, not a casino floor. Yet it carries a direct lesson for anyone who bets online: the platform's own supply chain is now part of your risk.

What happened in the Polymarket hack?

Polymarket's international platform switched to cancel-only mode at 2:05 p.m. Eastern time on Thursday and had normal trading back by 3:05 p.m. ET, according to its status page. Blockchain analytics firm Bubblemaps put the number of affected users at around 700. Polymarket hasn't confirmed the victim count or the exact sum, but it says the issue is fixed and affected traders will be made whole.

The mechanics matter for bettors. Researchers at Hudson Rock found a modified script hosted on the infrastructure of DebugBear, a UK-based website performance-monitoring provider. That code scanned logged-in sessions, checked balances and open prediction-market positions, then liquidated holdings and moved assets to an attacker-controlled wallet. Nobody clicked a phishing link. The malicious code ran inside the genuine Polymarket site.

On-chain tracking followed roughly $2.57 million in Polygon's POL token out of a central attacker wallet and into three addresses. It's the second supply-chain breach to hit Polymarket in four months; a June 2026 vendor compromise drained about $3 million.

Why should casino and sportsbook players care?

Every gambling site you use leans on third-party code, and that shared plumbing is where the real exposure sits. Payment processors, live-dealer feeds, odds widgets, chat tools and analytics snippets all run on someone else's servers. When one of those suppliers gets compromised, your balance can be at risk even on a licensed, well-run casino.

Two details from this story should sharpen your instincts. First, Polymarket told traders who lost more than $10,000 they'd need to sign release agreements before reimbursement. Big balances attract extra friction after an incident. Second, the platform confirmed losses under $10,000 would be restored by Friday, Oct. 30, which is faster than many casino payout queues we've tracked in our casino guides.

The prediction-market angle matters too. Polymarket US operates separately under US financial regulation and wasn't affected. If you bet on markets or sportsbooks, check which entity holds your money before you deposit.

What smart players should do after a breach like this

Treat platform security as part of your betting checklist, not an afterthought. A few habits cut your exposure fast:

• Keep balances lean. Withdraw winnings rather than parking a large float on any site, casino or prediction market. The $10,000 release-agreement threshold here is a reminder that bigger balances mean more hassle when things go wrong.
• Check the licence before you deposit. A regulated operator gives you a complaints route and clearer reimbursement rules. Our best online casinos page lists UK-licensed brands we've actually tested.
• Use the safety tools. Deposit limits and session timers on our responsible gambling tools page keep losses inside a range you can absorb.
• Watch for "too good" bonuses after an incident. Operators sometimes push casino bonuses to win back nervous players. Read the wagering before you bite.

If gambling stops feeling like fun, BeGambleAware.org offers free, confidential support.

The bottom line for players

This breach hit a crypto prediction market, but the lesson lands squarely on casino and sportsbook players: your money is only as safe as the weakest script on the site. Smart players keep balances small, bet only with licensed operators, and set limits before they play. If you're chasing big bonuses on an unlicensed site to "make back" a loss, stop and walk away.

18+. Play responsibly.