Polymarket international halt follows $2.7M script drain

Prediction markets got their own security scare a day before the midterms rush. The Polymarket international halt came after traders saw unauthorized withdrawals and the company traced the issue to a hacked third-party performance monitor.

What happened

A person familiar with the matter told CNBC the breach involved DebugBear, a website monitoring vendor based in the United Kingdom. Polymarket halted trading on its international platform, said it fixed the issue on its end and resumed trading at 3 p.m. ET. The U.S. platform was not compromised.

Analytics firms Betting Intelligence and Polysights told CNBC that one account withdrew at least $2.7 million across 710 other wallets. Polymarket said wallets with less than $10,000 taken would be restored by Oct. 30, while larger claims need a release form, and it referred the matter to U.K. authorities.

The international exchange runs as a DeFi venue on Polygon and is not U.S.-regulated. The timing, days before Nov. 3 midterm volume, made the outage especially awkward for a platform that already refunded users after a third-party compromise in June.

Frontend script attacks are especially dangerous for Magic-wallet style flows where a session can be hijacked without a fresh signature prompt. External-wallet users who saw unexpected sign requests were the lucky ones, because the prompt at least surfaced something odd.

The international venue's DeFi design is both the product and the vulnerability. Self-custodial flows and third-party scripts expand the attack surface beyond Polymarket's own servers, which is why a monitoring vendor could become the path into authenticated trading sessions.

Why it matters

The Polymarket international halt is a reminder that frontend and vendor scripts can drain wallets even when the core market contracts hold. That operational risk sits beside legal fights such as the Michigan sports contracts deal and the Utah Kalshi charges hanging over the rival exchange.

For election traders, the message is blunt: pause risk is real right when liquidity usually peaks.

Vendor risk is now a first-order election-week risk for prediction markets. A one-hour halt is survivable; a multi-day freeze into Nov. 3 would have been a different story.

What's next

Watch the refund window, DebugBear's own disclosure and whether midterm volume migrates to the U.S. venue. CNBC's Polymarket outage report carries the $2.7 million trace. The Polymarket international halt will be judged by how fast wallets are made whole.

DebugBear's disclosure quality and Polymarket's refund completion rate are the two process tells to watch before midterm volume peaks.

Prediction-market volume into the midterms is the prize both Polymarket and Kalshi are chasing. An operational scare this close to Nov. 3 is exactly the kind of event that can push cautious institutional flow toward the venue that stayed up.

Refund mechanics will also shape whether affected traders stay on the international venue or migrate their midterm books elsewhere for the final days before Nov. 3.