Polymarket confirms cyberattack on third-party provider after outages

Cryptocurrency-based prediction market Polymarket confirmed that it dealt with outages on Thursday due to a cybersecurity incident involving a third-party provider. 

The company suffered outages starting at 2pm EST on Thursday and eventually attributed the downtime to a compromise involving an unnamed provider.

A spokesperson for the company declined to answer questions about the incident, directing Recorded Future News to a statement that said it identified and fixed an issue impacting its international platform.  

“One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement,” the company said. 

“Anyone who has been impacted will be made whole. Out of an abundance of caution, we have temporarily halted trading & are working to bring the platform back online. Trading is now fully back online. We’ll make this right and are fully reimbursing all affected traders.”

The New York-based company did not say how much was stolen or by who. Several blockchain security companies traced the losses back to an account that allegedly siphoned more than $2.1 million worth of cryptocurrency from users on the site. 

Cybersecurity firm Hudson Rock said the unnamed third party provider was DebugBear — a company that provides website performance services. DebugBear said on Thursday that it is being “impacted by an ongoing security incident” and urged customers to remove its embed codes from their websites. 

According to Hudson Rock, it found evidence pointing to what it called “wallet-draining code” that was designed by someone to discover accounts, select assets and transfer funds to a designated account. 

Hudson Rock said it was unable to determine the number of victims or the total number of losses but did note that Polymarket removed DebugBear code from its site on Thursday. 

“The evidence does not identify an attacker or demonstrate a wider compromise affecting other DebugBear customers,” Hudson Rock said. 

Polymarket is one of the largest prediction markets in the U.S., allowing people to place bets on a variety of topics like politics, military conflicts, the weather and sports. It was banned in the U.S. until 2025, when President Donald Trump’s son joined the company as an advisor and investor. It is still banned in several countries, including France and Brazil.