Some users of prediction market platform Polymarket’s international exchange had funds stolen from their accounts due to a hack of an unnamed third-party provider on Thursday.
Polymarket has contacted law enforcement and pledged to reimburse any affected trader. It’s unclear how many users were impacted. The company’s U.S. platform was not compromised. As of Friday afternoon, the platform reported it has refunded 95% of affected wallets.
“In total, we’re returning $3.9M to traders: the $2.7M plus $1.2M to cover pause-related losses,” Polymarket wrote.
Traders first reported on social media platforms that they were seeing unauthorized withdrawals from their accounts on Thursday afternoon. In response, the company halted trading on its international platform.
Polymarket said that it has fixed the issue on its end, and that trading resumed at 3 p.m. ET on Thursday. It told users later in a chatroom on Discord that users who had less than $10,000 taken from their wallets will have funds restored by Oct. 30, and those with funds greater than that figure withdrawn will have to sign a release form to receive their restoration.
A person familiar with the matter told CNBC that the issue stemmed from a hack of DebugBear, a website performance monitoring platform. DebugBear in a post on X said that it was impacted by a security incident on Thursday. The person familiar with the Polymarket outage said that the company referred the matter to U.K. law enforcement, as that is where DebugBear is based.
DebugBear didn’t immediately respond to a request for comment.
An analysis of publicly-available data by two analytics firms — Betting Intelligence and Polysights — provided to CNBC said that an account on Polymarket Thursday withdrew at least $2.7 million across 710 other wallets.
“This is certainly a significant and new form of breach that we’ve seen on Polymarket,” said Dan Zimmermann, the chief intelligence officer at Betting Intelligence. “The timing right before the midterms …is certainly a wake up call for folks.”
Polymarket’s international prediction market exchange operates as a decentralized finance platform on the Polygon blockchain and is not regulated in the U.S.
The disruption comes just days before both the company’s international and U.S. exchanges are expected to see heightened volumes during the U.S. midterm elections on Nov. 3.
Back in June, a similar incident happened, when Polymarket said a third party vendor had been “compromised” and that the company would refund affected users.
Disclosure: CNBC and Kalshi have a commercial relationship that includes customer acquisition and a minority investment.
