Platforms · Software · Providers · Markets
Trading stopped during investigation
Polymarket stopped order activity on its international website on Thursday after a security compromise at a third-party provider. The company said it had fixed the problem, referred the matter to law enforcement and would compensate affected users. It expected trading to restart around 3 p.m. ET on Thursday.
During its investigation, the platform used a cancel-only setting. Customers could not submit fresh purchase or sale instructions, but could cancel orders already in place. Polymarket also paused relayer actions while it worked on the incident.
Reports from users that funds had left their accounts came before the trading stoppage. The Wall Street Journal linked the incident to DebugBear, a performance-monitoring service whose code ran on Polymarket's website. DebugBear said it was responding to a security incident and told customers to remove its embedded code.
Polymarket said it had put the issue right, but its initial announcement did not provide the full extent of the impact. A review of blockchain activity by The Wall Street Journal indicated that a wallet believed to be connected to the attacker had received more than $2.5 million from user accounts in more than 900 transactions. Finance Magnates also reported that the company had not set out the full scale of the incident in that first notice.
- New order submissions were blocked while existing orders remained cancellable.
- Relayer actions were paused during the response.
- The company expected trading to return around 3 p.m. ET on Thursday.
The integration question
For platform operators, the incident raises questions about where external monitoring code sits in the website and how quickly it can be isolated. Can that code be removed without disrupting core trading functions? What happens to order entry and relayer activity when the platform enters a restricted operating mode?
Polymarket has not disclosed the full scope of the incident or how the provider's code reached users. Operators reviewing their own dependencies should check what controls remain available during containment, how they communicate order status, and what records would support reconciliation and compensation if accounts are affected.
