On 2026-10-29 reporters said Polymarket users were being drained in real time, with roughly $2.68M reportedly stolen in about an hour through Polymarket's own deposit wallet infrastructure; a previously empty wallet started receiving funds at 17:05 UTC, hit $412K by 17:25, $2.02M by 17:50 and peaked at $2.68M at 18:05, with suspicious activity still recorded at 18:10 UTC. (Unverified.)
[1]← Narrative indexOct 25 – Oct 31 UTC Every claim links to the posts behind it01 02 03 04 05 06 07 08 09 10 6 posts on X 1 week
Microtrend / Rank 24 / Week of Oct 25 – Oct 31
Polymarket halts trading ~1 hour after a third-party breach drains users; says it will reimburse and refers incident to UK law enforcement
Peak / day7tracked accounts
Peak dayThuOct 29 · busiest day in the panel
Rest of X / peak day—not measured outside the panel
Cited claims101 dropped by automated checks
Market—no token attached
Attention
Who was talking, day by day
Tracked paneldistinct tracked accounts / day
What happened
On 2026-10-29 reporters said Polymarket users were being drained in real time, with roughly $2.68M reportedly stolen in about an hour through Polymarket's own deposit wallet infrastructure; a previously empty wallet started receiving funds at 17:05 UTC, hit $412K by 17:25, $2.02M by 17:50 and peaked at $2.68M at 18:05, with suspicious activity still recorded at 18:10 UTC. (Unverified.) On 2026-10-29 bitcoinnewscom reported that Polymarket halted trading after attackers allegedly exploited users' active sessions to sell positions and withdraw funds through Polymarket's own system, that the attack reportedly originated from a compromised DebugBear website performance monitoring script replaced with malicious code, that trading resumed after roughly one hour, and that Polymarket says affected users will be reimbursed and the incident has been referred to UK law enforcement.
+ 8 more in the evidence register ↓Why it matters
It is a live example of a crypto platform being compromised through a trusted third-party dependency rather than stolen passwords or seed phrases, exactly the vector prediction-market and DeFi users worry about, and it forced Polymarket to halt trading and promise reimbursements. It also lands against a backdrop of Polymarket scrutiny (a reported CFTC probe and insider-trading wallet analysis) and comes as the market's first tracked mention of the week was about its stablecoin flows (pUSD), showing the platform is a central CT reference point.
Observed reaction
Shock and urgency on the day, with bitcoinnewscom and starplatinum_ treating it as a serious live exploit; icplegend1966 and yichuan_drive frame it as another industry warning. Traders' ire is mixed — akuwazir calls it 'getting hacked to dust' and lists prior troubles, while aduwaye77 stays positive on Polymarket's liquidity via a third-party app. The Brazilian political-law accounts (charlitosrosa, charlesnisz, carlosmaslaton, salgadowisk) treat Polymarket odds as a foil for election commentary rather than commenting on the breach.
Spread
Where it started and who carried it
- First seen
- Oct 25, 06:59 UTC by @vadim_web3
- Accounts
- 5 tracked · 15 elsewhere on X
- Communities
- general ct (2), prediction mkts (2), eth defi (1)
- Key accounts
- @charlitosrosa, @charlesnisz, @carlosmaslaton, @aduwaye77, @salgadowisk
Explainability
Evidence register
On 2026-10-29 bitcoinnewscom reported that Polymarket halted trading after attackers allegedly exploited users' active sessions to sell positions and withdraw funds through Polymarket's own system, that the attack reportedly originated from a compromised DebugBear website performance monitoring script replaced with malicious code, that trading resumed after roughly one hour, and that Polymarket says affected users will be reimbursed and the incident has been referred to UK law enforcement.
[1]On 2026-10-30 icplegend1966 amplified the same report, describing Polymarket halting trading after attackers reportedly drained user funds without stealing passwords or seed phrases via a compromised DebugBear monitoring script and malicious JavaScript delivered through a trusted third-party dependency that executed inside users' browsers. (Unverified.)
[1]On 2026-10-30 yichuan_drive said Polymarket was hit for roughly $2.6m in a third-party breach, and also referenced a roughly $6.3b Binance incident with around $3b frozen so far, and a claim by @CarOnPolymarket of an $800k drain shortly after Polymarket's announcement. (Unverified.)
[1]On 2026-10-29 akuwazir said four reasons explain why Polymarket is 'getting hacked to dust', citing a fresh CFTC investigation into whether Polymarket violated a 2022 enforcement settlement requiring it to ban U.S. users, and an internal team plus Polysights and Bubblemaps investigating dozens of newly created wallets suspected of insider trading around a Benjamin Netanyahu market. (Unverified.)
[1]Separately from the hack, on 2026-10-25 ikarusz26 said Polymarket fired its chief marketing officer Matthew Modabber, who was closely allied with CEO Shayne Coplan, per a New York Post report following an internal investigation, and speculated his $POLY hint before Token2049 was intentional.
[1]On 2026-10-25 vadim_web3 said Polygon $POL has 25x more than NEAR and that this most likely excludes Polymarket's pUSD, which adds another $500M.
[1]On 2026-10-25 aduwaye77 described testing @Bagel_win to trade prediction markets from a phone, saying it hooks into Polymarket's global liquidity (accessible in 150+ countries) and offers 1-tap copy trading and a social feed.
[1]On 2026-10-27 charlitosrosa and charlesnisz both said Datafolha puts the risk of Flávio Bolsonaro fleeing at 47% with a 3% margin of error, Quaest's 'likely fugitive' model puts it at 49%, and Polymarket odds are 75% for no flight.
[1][2]On 2026-10-26 carlosmaslaton said Polymarket expresses wishes rather than electoral will or a political machine's ability to swing voters, and salgadowisk said Polymarket did not only turn on Zanin's decision because models already predicted the reversal.
[1][2]Angles
- Explainer thread: how the DebugBear supply-chain attack worked (compromised monitoring script → malicious JS in browsers → stolen sessions), and why passkeys/seed phrases don't help.
- On-chain timeline card using the starplatinum_ wallet trace: 17:05 UTC empty wallet → 17:25 $412K → 17:50 $2.02M → 18:05 peak $2.68M, with the attacker address.
- Response-and-policy angle: Polymarket's roughly 1-hour trading halt, its reimbursement promise, and the referral to UK law enforcement — what it means for prediction-market trust and the reported $POLY token talk.
Formats in use
- on-chain wallet timeline with exact UTC times and attacker address
- quote-post of a news report
- warning-style all-caps alert post
- numbered 'reasons' breakdown
- Brazilian election odds commentary screenshot/quote
- mobile app hands-on review thread
Risks
- The hack details are unverified; mark all figures ($2.68M, $412K, $2.02M, 28.6M $POL) and mechanisms as reported/unverified.
- Do not present the $POLY token, the Modabber firing or the CFTC probe as confirmed causes of the breach.
- Flag the @Bagel_win and any other product mentions as potential paid promotion/coordinated shilling under brand-safety rules.
- Avoid any price talk on $POL, $POLY or $ICP, and avoid naming or harassing individual suspects; the attacker is identified only by a wallet address.
- Separate Brazilian election commentary from the hack narrative so the card stays about the most distinct development.
Observed content
Most-engaged posts
New crypto meta: get hacked, get drained or Bull run for hackers Hacks, drains, deleted posts, way too much drama lately. And some of these protocols n people already had a history of questionable behavior on @ethos_network 👀 ✍️ @Polymarket: hit for roughly $2.6m in a third-pOpen on X →
Cool, Polygon $POL has 25x more than NEAR, and this most likely doesn’t even include Polymarket’s pUSD, which adds another $500M. https://t.co/WF6Q5wKjbwOpen on X →
I feel like him getting fired has bigger implications for Polymarket’s path toward a more conservative approach, especially considering his history with Shayne. I’d speculate his post hinting $POLY before Token2049 was intentional, as he knew what was about to happen.Open on X →
$ICP ♾️🚨 POLYMARKET HALTS TRADING AFTER HACKERS REPORTEDLY DRAIN USER FUNDS WITHOUT STEALING PASSWORDS OR SEED PHRASES! 🔐🔥 Another serious warning for the cryptocurrency industry! Polymarket reportedly suspended trading following an attack involving compromised third-party wOpen on X →
4 reasons why polymarket is getting hacked to dust the proof 1: few weeks ago the U.S. Commodity Futures Trading Commission (CFTC) launched a fresh investigation into Polymarket over whether it violated a 2022 enforcement settlement that required the platform to ban U.S. 2: poOpen on X →
Segundo o Datafolha, o risco de fuga do Flávio Bolsonaro é de 47%, com margem de erro de 3%. Já a Quaest, que usa um modelo preditivo bastante original (likely fugitive), o risco de fuga de Flávio Bolsonaro chega a 49%. As odds no Polymarket são de 75% para não-fuga.Open on X →
History