Polymarket Hack on October 29: What Happened and What It Means for Copy Traders

On 29 October 2026, a script that Polymarket's website loaded from an outside provider was replaced with code that drained signed-in users. Polymarket paused trading for about an hour, fixed the cause and said everyone affected will be made whole. Copies placed through Whalidate never go through Polymarket's website, so the script could not reach them.

What happened?

A third-party provider was compromised, and its code reached Polymarket.com. Polymarket paused trading, removed the cause and reopened the same afternoon.

Polymarket said it had referred the case to law enforcement. It has not named the provider. A source familiar with the matter told Reuters it was DebugBear, a website performance monitoring service. DebugBear wrote on X that it was "impacted by an ongoing security incident" and asked customers of its monitoring product to remove its code from their websites.

How did the attack work?

The script ran inside the browser of anyone who had polymarket.com open, with the access of their signed-in session.

According to Hudson Rock, cited by Unchained, the script served from DebugBear's servers looked for users signed in to Polymarket, checked their holdings and tried to drain or transfer them. Websites load scripts like this one to measure page speed, and they run with the same rights as the page itself.

Polymarket has not published a loss total or the number of accounts hit. The Block, citing Arkham data, put the amount in the suspected attacker's wallet at about $2.65 million.

Is Polymarket safe to use now?

Polymarket says the cause is fixed, trading has been running since the afternoon of 29 October, and affected users will be reimbursed.

In its words, "Anyone who has been impacted will be made whole." The malicious code came in through the website, and no flaw in Polymarket's trading contracts has been reported.

Were Whalidate users affected?

Copies placed through Whalidate were out of the script's reach.

• The script could act only inside a browser with polymarket.com open and a user signed in. Whalidate places copies from its own servers through Polymarket's order API, and no Polymarket web page is opened along the way, so there was no session for the script to use.
• whalidate.com loads no scripts from outside providers. app.whalidate.com loads one, Cloudflare's captcha: the sign-up, forgot-password and "Check your inbox" screens request it, and it stays in that tab until the page reloads. The rest of the app, including sign-in and the trading screens, doesn't request it. We checked both on 30 October.
• While Polymarket was in cancel-only mode, from 2:05 to about 3:00 p.m. ET, nobody could place new orders on the exchange, copies included.

If you also trade on polymarket.com with your own account, check your activity for 29 October and follow Polymarket's official channels about reimbursement. Ignore direct messages that offer help with refunds.