For: people who use Polymarket, and people who run websites that load scripts from outside services. This article is based on Polymarket's official status page and press reports, and does not describe how to carry out such an attack.
Developing: this article will be updated as the organisation publishes more
As of October 31, 2026Not yet known
- Official loss amount
- Number of users affected
- How reimbursement will work
- How the third party was compromised
Polymarket's status page marked the incident resolved on October 29. It has not published a follow-up report that we could find on October 31. The provider is reported to have told its own customers to remove its script.
What users should do today
Check your account on the official site
Open Polymarket by typing the address yourself (not from a link in a message) and review your positions, balances and recent activity for October 29. If something does not match what you did, contact Polymarket through the support channel listed on its official site.
Do not act on reimbursement messages
Polymarket's status page says affected users will be compensated but gives no claim process. Scammers commonly use moments like this. Do not click links in emails, direct messages or replies, do not connect your wallet to a new site, and do not sign anything to "claim" funds. Wait for an announcement on the official site or status page.
Never share your recovery phrase or private key
No legitimate support team needs them. This applies whether the message mentions Polymarket or not (What is phishing?).
Treat this as a reason to review your own exposure
This site does not give financial advice. In general, funds you do not need on a trading platform are safer elsewhere, and a platform that is compensating users does not remove the risk of your next login being targeted by a scam. Reuse of passwords across services is a separate risk (how to check if your password leaked).
What happened (per Polymarket and press)
Official times below come from Polymarket's status page, converted from UTC to Eastern Time (the page lists UTC). Times marked as press come from press reports of a security research firm's analysis, not from Polymarket.
October 29, 2026, 1:50–1:56 p.m. ET (press)
BleepingComputer's own review of blockchain activity shows transactions from a suspected attacker wallet involving a prediction-market token contract between 1:50 and 1:56 p.m. ET.1:59 p.m. ET (press)
Press reports, citing a security research firm, that a Polymarket production build removing the third-party monitoring integration is timestamped at this time.2:05 p.m. ET (Polymarket)
Status page: exchange in cancel-only mode and relayer actions paused while investigating.2:37 p.m. ET (Polymarket)
Status page: issue identified and fixed; a third-party provider was compromised; referred to law enforcement; anyone impacted will be made whole; trading temporarily halted out of an abundance of caution.About 3 p.m. ET (Polymarket)
Trading was expected to resume; the status page marked the incident resolved at 3:05 p.m. ET. Press says trading resumed about an hour after the halt.
- Service
- Polymarket.com, the international platform. Press reports the US platform was not affected; Polymarket's page names only the international platform
- What Polymarket says
- A third-party provider was compromised; the issue was identified and fixed; referred to law enforcement; affected users will be compensated
- What the press reports (not Polymarket)
- The provider is a website performance-monitoring service whose script loaded on Polymarket pages. Reported behaviour: it acted on the accounts of users who were logged in, either selling their positions or moving position tokens to an address chosen by the attacker. A research firm (per SecurityWeek) said it found no code sending credentials, passwords, recovery phrases or private keys to the attacker; the script reportedly mainly reused the logged-in session's rights
- Amount
- Not disclosed by Polymarket. Press and analytics firms traced roughly $2.2 to $2.7 million to suspected wallets. The lower figure is a research firm's number for one wallet's holdings, which SecurityWeek says is not a verified tally. One analytics firm's view, as reported by SecurityWeek, is that address counts do not equal victim counts
- Provider response
- Press reports the provider confirmed a security incident and told its customers to remove its script
What is known and what is not
Status as of October 31, 2026.
| Item | What is said | Status |
|---|---|---|
| Third-party provider compromised | Polymarket status page, October 29 | Confirmed (Polymarket) |
| Trading halted and resumed | Temporarily halted at 2:37 p.m. ET; resolved 3:05 p.m. ET | Confirmed (Polymarket) |
| Law enforcement referral | Stated on status page | Confirmed (Polymarket) |
| Users to be compensated | "Affected users will be compensated" | Confirmed (Polymarket), details not disclosed |
| Provider type | Website performance-monitoring service | Press reports (two outlets) |
| Behaviour of the script | Sold or moved logged-in users' holdings | Press reports, research firm's analysis |
| Amount | About $2.2 to $2.7 million traced | Press estimate, no official figure |
| Number of users affected | Not stated | Not disclosed |
| How the provider was compromised | Not stated | Under investigation (per press) |
| Passwords or recovery phrases taken | Research firm found no code sending them out | Third party's finding; not confirmed by Polymarket |
Why a third-party script is a risk on a logged-in page
A script that a website loads from an outside service runs with the same access as the site's own code. In general, on a page where the user is logged in, such a script can see what the user sees and act with the session the user already has. That is why a compromise at the outside provider can reach the site's users without the site's own servers being breached. This is the general reason, not an extra detail about this incident.
Two features of this case stand out in the public record. The affected provider's script was a monitoring tool, which many sites add for performance data and which runs on every page. And per press, a Polymarket build removing the integration was timestamped about 10 minutes after the first suspicious transactions, which shows how fast the exposure can end once a site can switch the script off.
For site operators: three checks from what is public
Polymarket has not published a cause, so this section does not judge its measures. It uses only the facts above.
List every outside script on pages where users are logged in
Include analytics, monitoring, chat widgets and tag managers. For each, write down who owns it, why it is there, and who can switch it off. Remove any you do not need, especially on pages that move money or change account settings. See security headers that still matter.
Limit what outside scripts can do
A content security policy can restrict where scripts load from and where they can send data. Subresource integrity checks help when a script is served as a fixed file, but they do not help when the provider legitimately changes the file, so for the highest-risk pages consider serving the script from your own domain after review, or not loading it at all.
Do not let a session alone authorise high-value actions
Require a fresh confirmation (a signature prompt, a second factor or a delay with a notification) for sales, withdrawals and address changes. Then a script that can only use the existing session cannot complete them quietly.
This site's view: the first minutes matter most
Per press, a build removing the integration was made about 10 minutes after the first suspicious transactions. Keeping a documented way to disable any outside script quickly, and an alert on unusual transaction patterns, are what turn a long incident into a short one.
A third-party provider's script was compromised
↓→
Which outside scripts load where users are logged in?
Script acted through logged-in sessions (press)
↓→
Do high-value actions need a fresh confirmation?
Build removing it about 10 minutes later (press)
↓→
Can you switch off any outside script quickly?
Sources (public record)
- Polymarket status page, "Polymarket exchange disruption" (October 29, 2026) — status.polymarket.com
- BleepingComputer, "Polymarket halts trading after crypto-draining script breach, $2.5M traced" (October 2026) — bleepingcomputer.com
- SecurityWeek, "$2 million drained from Polymarket traders in new supply chain attack" (October 30, 2026) — securityweek.com
The press reports are used for the provider type, the script's reported behaviour and the amounts, and are marked as such above. Press also quotes the company's statement; we rely on the status page for official wording.
Update history
2026-10-31: First version, based on Polymarket's status page and two press reports. We will update this article when Polymarket publishes a loss figure, a reimbursement process or a cause.
Read next
- Same kind of incident: APORITO Online Store (RIZAP) possible card data leak
- Crypto theft: Bitget crypto theft
- Other 2026 incidents: Data breaches and cyberattacks in 2026