Polymarket Halts Trading After Security Incident and Stolen Funds
Left 80%
Center 0%
Right 20%
4 left · 0 center · 1 right
What happened
On Thursday, prediction-market platform Polymarket halted trading on its international website Polymarket.com for nearly an hour after what it described as a compromise of third-party software. Users reported unauthorized withdrawals from their wallets on Discord; blockchain analysis cited by The Block estimated $2.65 million in cryptocurrencies siphoned, a figure Polymarket did not confirm. The company attributed the incident to a compromise of DebugBear, a UK-based web analytics tool that reported its own security incident around 2 p.m. ET, referred the matter to British law enforcement, and pledged to fully reimburse affected traders. Trading resumed at 3 p.m. ET; Polymarket’s U.S. platform was unaffected.
Sourcing check · Fully on the record · 5 articles
5 of 5 articles cite a named source for the story. It was on the record from the first report.
What these terms mean and how they're counted
- On the record · names a source 5 of 5
- On the record means the article cites a source by name for the story's main claim: a person, or an institution speaking officially, such as a company statement or a named agency's spokesperson. The opposite is an unnamed source. The count is how many of the counted articles cite at least one such source; the names are everyone named across them, each once however the articles spell it. Here: Polymarket, DebugBear, Binance, Changpeng Zhao, Paolo Ardoino and Jeremy Allaire
- Primary evidence · cites a document or data 1 of 5
- Primary evidence means the article cites a record you could check yourself: a court filing or ruling, a dataset or report, a recording or transcript, an official statement or press release, market data. A quote is not a document. The count is how many articles cite one. Here: company statement, analytics report
- Credits another outlet 0 of 5
- The article says the story comes from another outlet's reporting (“first reported by Reuters”). Those articles relay the story; they are not independent confirmation. Here: Each article presents its own reporting.
- Unnamed sources 1 of 5
- The main claim is attributed to people who are not identified: “people familiar with the matter”, “officials said”. The count is how many articles do this. Here: e.g. “a person familiar with the details”
- How it developed
- When the first report landed and whether it named anyone; when the first named source and the first document appeared. Here: First report Oct 29, 19:09 UTC by NBC News, naming its source. First document 4 hours later, from CNBC (company statement).
- Not counted 0
- Opinion, analysis and video pieces, and articles too short to assess. Every count above is out of the counted articles. An article republished under a new headline is one article.
This is about who is cited, not whether the story is true. Each source below says what it names. How we count
Omitted — what each side leaves out
Unpacked
Right-leaning coverage omits Polymarket's promise to repay victims and the same-day return of trading. Left-leaning coverage reports both, which recasts a freeze as a brief outage the firm said it would cover. The international platform came back after the halt, CNBC reported. That outlet also said the company "pledged to reimburse any affected trader." The Washington Examiner reports the pause and the theft without the restart or the repayment pledge.
Right-leaning coverage leads with money leaving wallets; left-leaning coverage leads with a vendor breach and a short shutdown. The Washington Examiner frames the theft as happening "within minutes." NBC News opens on a halt after a third-party compromise.
None of the coverage explains how a website-performance vendor could authorize withdrawals from user wallets.
Bottom line
A Washington Examiner reader never learns that Polymarket pledged to cover the losses, so the $2.65 million theft reads as money gone rather than money the company said it would replace.
The receipts — 5 facts one side's coverage lacks
- Trading resumed at 3 p.m. ET after nearly an hour offline
- The compromised vendor was DebugBear, a U.K. website-performance firm
- Polymarket referred the incident to British law enforcement
- Users who lost under $10,000 would be restored by Oct. 30; larger losses required a signed release
- Funds were described as siphoned from wallets within minutes
The Left View
NBC News and CNBC framed the incident as a significant breach because actual user funds were stolen via a third-party vendor, quoting Polymarket’s pledge that “anyone who has been impacted will be made whole” and “We’ll make this right.” They placed it against the company’s $21 billion valuation after a Donald Trump Jr.-led investment, $200 million daily volume, state-versus-administration fights over prediction-market regulation, and probes into suspicious midterm and Israel-election bets, with CNBC calling the pre-midterms timing “a wake up call” and noting a similar June vendor compromise.
The Right View
The Washington Examiner reported a concise account of Polymarket pausing trading on its international platform after a “security incident” that “siphons $2.65 million in minutes” from users’ wallets due to a compromised third-party provider.
Our Take (balanced)
Left-leaning sources’ strongest argument is that the theft of user funds via third-party compromise is a notable failure for a high-valuation platform, supported by the $2.65 million blockchain estimate, Discord reports, and Polymarket’s own reimbursement language amid its regulatory and political profile. Right-leaning coverage’s strongest argument is the unadorned fact of a minutes-long siphoning that forced an hour-long halt. The central unresolved tension is Polymarket’s non-confirmation of the loss amount or user count versus the blockchain figures, and whether the political-regulatory backdrop belongs in the story of this incident.
5 sources
- Polymarket briefly halts trading after third-party compromise and reports of stolen user funds
- Some Polymarket user funds stolen by hackers; exchange referring matter to U.K. authorities
- Polymarket Is Investigating Suspicious Bets on Israeli Election
- Binance and Polymarket are investigating potential hacks. The former says $6.3 billion is affected.
- Polymarket halts trading after ‘security incident’ siphons $2.65 million in minutes
More stories
The week's bottom lines, in your inbox
One email a week: the five stories that mattered and what they actually mean. Free.