conv.

All stories
SecurityQuiet 10d · day 13

Polymarket halts trading after hack of vendor DebugBear drains user wallets

A breach at a third-party analytics provider let hackers siphon an estimated $2.65 million from Polymarket users before the exchange froze trading and pledged full reimbursement.

newest coverage 10d agosummary written 13d ago107 pieces1.4k likes & upvotes128 comments NewswiresHacker NewsMastodonGoogle NewsXRedditBluesky

What to know

  • Hackers exploited a compromised third-party vendor, DebugBear, to drain Polymarket user wallets, forcing a near hour-long trading halt on its international platform.
  • Blockchain analysis firm Arkham estimated about $2.65 million in cryptocurrency was stolen; Polymarket has not confirmed the figure.
  • Polymarket says the attack appears to originate in the UK and has referred the matter to British law enforcement; it has pledged to fully reimburse affected traders.
  • The breach hits a platform valued at $21 billion after a Trump Jr.-led investment, and comes amid separate Polymarket and Kalshi probes into suspicious election-related bets and a regulatory fight with U.S. states days before the midterms.

Polymarket Prediction-market platformDebugBear Third-party web analytics/performance vendorShana Bautista Polymarket head of global intelligence and investigationsDonald Trump Jr.Donald Trump Jr. Lead investor in Polymarket

Polymarket halts trading after hack of vendor DebugBear drains user wallets
nbcnews.com

How it unfolded 6 developments, newest first · click a bar or a number to jump articlespostscomments

Peak 39 pieces in 3h at Oct 29, 2 PM; 107 pieces over 13 days (66 articles · 35 posts · 6 comments) Oct 29, 2 PM — 39 pieces · 30 articles · 9 posts — Google News 15, Newswires 14, Hacker News 5, +3 moreOct 29, 5 PM — 38 pieces · 29 articles · 9 posts — Newswires 28, Mastodon 3, X 3, +3 moreOct 29, 8 PM — 2 pieces · 2 posts — Mastodon 2Oct 29, 11 PM — 2 pieces · 1 article · 1 post — Mastodon 1, Newswires 1Oct 30, 2 AM — quietOct 30, 5 AM — 10 pieces · 4 articles · 6 posts — Newswires 4, Mastodon 3, Hacker News 2, +1 moreOct 30, 8 AM — 2 pieces · 1 article · 1 comment — Reddit 1, Newswires 1Oct 30, 11 AM — 5 pieces · 1 article · 1 post · 3 comments — Hacker News 4, Newswires 1Oct 30, 2 PM — 3 pieces · 1 post · 2 comments — Hacker News 2, Mastodon 1Oct 30, 5 PM — quietOct 30, 8 PM — quietOct 30, 11 PM — quietOct 31, 2 AM — quietOct 31, 5 AM — quietOct 31, 8 AM — quietOct 31, 11 AM — 1 piece · 1 post — Mastodon 1Oct 31, 2 PM — 1 piece · 1 post — Mastodon 1Oct 31, 5 PM — quietOct 31, 8 PM — quietOct 31, 11 PM — 3 pieces · 3 posts — Mastodon 3Nov 1, 1 AM — quietNov 1, 4 AM — quietNov 1, 7 AM — quietNov 1, 10 AM — quietNov 1, 1 PM — quietNov 1, 4 PM — quietNov 1, 7 PM — 1 piece · 1 post — Mastodon 1Nov 1, 10 PM — quietNov 2, 1 AM — quietNov 2, 4 AM — quietNov 2, 7 AM — quietNov 2, 10 AM — quietNov 2, 1 PM — quietNov 2, 4 PM — quietNov 2, 7 PM — quietNov 2, 10 PM — quietNov 3, 1 AM — quietNov 3, 4 AM — quietNov 3, 7 AM — quietNov 3, 10 AM — quietNov 3, 1 PM — quietNov 3, 4 PM — quietNov 3, 7 PM — quietNov 3, 10 PM — quietNov 4, 1 AM — quietNov 4, 4 AM — quietNov 4, 7 AM — quietNov 4, 10 AM — quietNov 4, 1 PM — quietNov 4, 4 PM — quietNov 4, 7 PM — quietNov 4, 10 PM — quietNov 5, 1 AM — quietNov 5, 4 AM — quietNov 5, 7 AM — quietNov 5, 10 AM — quietNov 5, 1 PM — quietNov 5, 4 PM — quietNov 5, 7 PM — quietNov 5, 10 PM — quietNov 6, 1 AM — quietNov 6, 4 AM — quietNov 6, 7 AM — quietNov 6, 10 AM — quietNov 6, 1 PM — quietNov 6, 4 PM — quietNov 6, 7 PM — quietNov 6, 10 PM — quietNov 7, 1 AM — quietNov 7, 4 AM — quietNov 7, 7 AM — quietNov 7, 10 AM — quietNov 7, 1 PM — quietNov 7, 4 PM — quietNov 7, 7 PM — quietNov 7, 10 PM — quietNov 8, 1 AM — quietNov 8, 4 AM — quietNov 8, 7 AM — quietNov 8, 10 AM — quietNov 8, 1 PM — quietNov 8, 4 PM — quietNov 8, 7 PM — quietNov 8, 10 PM — quietNov 9, 1 AM — quietNov 9, 4 AM — quietNov 9, 7 AM — quietNov 9, 10 AM — quietNov 9, 1 PM — quietNov 9, 4 PM — quietNov 9, 7 PM — quietNov 9, 10 PM — quietNov 10, 1 AM — quietNov 10, 4 AM — quietNov 10, 7 AM — quietNov 10, 10 AM — quietNov 10, 1 PM — quietNov 10, 4 PM — quietNov 10, 7 PM — quietNov 10, 10 PM — quietYesterday, 1 AM — quietYesterday, 4 AM — quietYesterday, 7 AM — quietYesterday, 10 AM — quietYesterday, 1 PM — quietYesterday, 4 PM — quietYesterday, 7 PM — quietYesterday, 10 PM — quiet 1–6
Oct 30Oct 31Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9Nov 10now · 12:12 AM ET
  1. 6

    Trading resumes in cancel-only mode as probe continues

    Polymarket brought its platform back online in a cancel-only trading mode while it continued investigating the breach, according to Wired and Quartz.

    • drahardja@sfba.social

      “Polymarket referred the incident to UK law enforcement and pledged to reimburse affected traders. By Friday afternoon, it said 95% of affected wallets had been refunded. The company said it was returning $3.9 million in total: $2.7 million for stolen funds and another $1.2 million to cover losses linked to the trading pause.” # crypto https://…

      drahardja@sfba.socialMastodon10d ago1▲view on Mastodon ↗
    2 more of the top 3 · 19 posts in this stretch

    • This is the same style of attack that took 1.5B from Bybit ~1yr ago.Fundamentally: There is no way to lock webapps to reproducible builds.Except: IPFS could do it but IPFS has been very very poorly maintained.I published IPFS-boot ~1yr ago and its a simple idea:1. deploy a webapp bootloader using something immutable like IPFS2. bootloader is…

      rhodeyHacker News12d agoview on Hacker News ↗

    • “Predictions markets platform Polymarket was forced to halt trading on its international platform Thursday for nearly an hour because of what it said was a third-party compromise. — There were also unconfirmed reports from users on Polymarket's Discord channel who said their wallets had been drained. …

      @tyleraking.comBluesky13d agoview on Bluesky ↗
    all of them →
  2. 5

    Polymarket says attack traced to the UK, calls in authorities

    Polymarket said the attack appeared to be emanating from the United Kingdom and that it had referred the matter to British law enforcement authorities.

  3. 4

    Analysts estimate $2.65 million stolen via Arkham data

    Crypto outlet The Block, citing blockchain analysis firm Arkham, reported that roughly $2.65 million in cryptocurrency had been siphoned from Polymarket users' wallets; Polymarket declined to confirm the figure.

    “One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement…”
    — Polymarket, company statement on X · source
  4. 3

    Polymarket pledges to make affected traders whole

    Polymarket confirmed on X that a third-party provider had been compromised, said it had referred the matter to law enforcement, and promised full reimbursement to anyone impacted.

    “We'll make this right and are fully reimbursing all affected traders…”
    — Polymarket
    1. 1 outlet Polymarket trading halted after vendor compromise; impacted users will be ‘made whole’

      first by NBC News, 13d ago

  5. 2

    Reports surface that a third-party breach caused user losses

    CoinDesk and other outlets reported that one of Polymarket's third-party providers had been breached after users said their accounts were drained, with the compromised software later identified as coming from DebugBear.

    1. 13 outlets Polymarket ‘Fully Reimbursing’ Users After Halting International Trading Amid ‘Compromised’ Third-Party Provider

      first by Forbes, 13d ago · also The Economic Times, Associated Press, Orlando Sentinel, Baltimore Sun, Mercury News, Philadelphia Inquirer +6

      7 more headlines
    2. 3 outlets Compromised Software Caused Polymarket To Pause Trading. Some Users Said Funds Had Been Stolen.

      first by International Business Times, 13d ago · also Bloomberg, Yahoo

      1 more headline
    3 more claims →
  6. 1

    Polymarket suspends trading on its international platform

    Polymarket halted trading on Polymarket.com for nearly an hour, initially describing it as an outage, after users began reporting wallet drains on the company's Discord channel.

    1. 4 outlets first by The Paypers, 13d ago · also Washington Post, Washington Examiner, Guardian · read ↗

    2. 3 outlets Polymarket halts trading after provider compromise

      first by TheStreet, 13d ago · also NBC News, HN Frontpage

      2 more headlines
    3 more claims →

    • Polymarket has been hacked, users have reported their money got stolen >Users reported suspicious activity, missing money and positions being closed without their permission. >Polymarket blamed the issue on a vulnerability in an external authentication provider. >Money stolen,

      @Pirat_NationX13d ago1.2k▲view on X ↗
  7. background

    DebugBear reports an 'ongoing security incident' — Web analytics and site-performance vendor DebugBear, whose software Polymarket used, posted on X that it was experiencing an ongoing security incident around 2 p.m. ET, the point at which hackers are reported to have gained access to user funds.

Also covered reported alongside — the timeline has no entry for these yet

  1. 4 outlets Polymarket Hack Drains $2.7M From 700 Users as Third-Party Breach Forces Trading Halt

    first by Yahoo Finance, 13d ago · also CoinGape, CNBC, Bitcoin News

    3 more headlines
  2. 2 outlets Polymarket restores trading after security breach, assures affected users of full refunds

    first by Digit, 13d ago · also Wall Street Journal

    2 more headlines
  3. 2 outlets The Morning Risk Report: Binance and Polymarket Suspend Trading After Hacks

    first by WSJ Markets, 12d ago · also WSJ

  4. 2 outlets Some Polymarket user funds stolen by hackers; exchange referring matter to U.K. authorities

    first by Mastodon, 13d ago · also CNBC

and 4 smaller pieces

What people are saying 14 voices from 4 sites · best of 20 · verbatim