Polymarket pauses trading after a vendor breach drains user accounts
Polymarket halted trading on its international exchange on 29 October 2026 after attackers used a flaw in a third-party monitoring tool to drain user funds, reportedly about $2.7 million. The company says affected users will be made whole and has referred the matter to law enforcement.
Many South Africans use offshore crypto betting and trading sites because local options are limited, and those sites hold your money in ways a licensed local bank or bookmaker does not. This incident shows that even a large, well-funded platform can lose customer funds through a supplier it does not control. It is a practical reminder to keep only what you are prepared to lose on any such platform, to use unique passwords and two-factor authentication, and to be wary of sites that have no clear complaint route or regulator behind them.
What happened
Polymarket paused trading on its international platform on Thursday 29 October 2026 after users reported that their accounts had been emptied. CNBC reports that the problem came from a compromise of DebugBear, a website performance monitoring service used on Polymarket's site, citing a person familiar with the matter.
Reports differ on how long trading was off: NBC News describes a halt of nearly an hour, while iGaming Business puts it at nearly four hours. Trading has since resumed.
How much was lost
CNBC cites analysis by two data firms showing at least $2.7 million moved out across about 710 wallets. iGaming Business, citing the tracking firms Bitquery and Arkham, reports roughly $2.73 million from about 737 accounts over around an hour, with a median loss of $171 per account and four accounts losing more than $100,000 each.
Polymarket said on X that anyone affected would be made whole, and iGaming Business reports at least 689 accounts had been refunded in full by Friday afternoon. The company says it is working with law enforcement and CNBC reports the matter was referred to UK authorities, since DebugBear is based there.
What it means for South African players
The weak point here was a supplier, not a stolen password, so personal habits alone would not have prevented it. That makes the size of your balance the one thing you control. Do not leave more on an offshore or crypto platform than you would be comfortable losing, and withdraw winnings rather than storing them.
We do not rate Polymarket or review it, and nothing here is a view on its legality for South African users. For licensed-operator checks on casinos, see our casino reviews, which show what has and has not been verified.
What to watch next
- Whether the full cause and final loss figure are confirmed by Polymarket
- Whether all affected accounts are refunded
- Any regulatory response to supplier risk at crypto-based platforms