Polymarket Halts Trading After Security Breach at UK Vendor DebugBear

Polymarket paused trading on its international platform for about an hour Thursday after a security incident compromised a third-party provider, the company said.

Trading stopped Thursday and resumed Thursday afternoon. Polymarket has promised to fully reimburse any affected traders.

The prediction market platform said it halted trading "out of an abundance of caution" after identifying and fixing the issue affecting its international platform.

"We'll make this right and are fully reimbursing all affected traders," the company posted on X once trading had resumed.

Who is behind the breach?

Polymarket referred the incident to a law enforcement agency in the United Kingdom. Reports have linked the source of the incident to DebugBear, a UK-based company offering website performance monitoring tools.

DebugBear's own website was unavailable Thursday afternoon. The company posted on X that it was "impacted by an ongoing security incident." It also advised clients who were using one of its products to remove the embed code from their websites. DebugBear did not immediately respond to a request for comment.

A monitoring vendor's embed code became the attack path — and its clients, Polymarket included, paid the price in downtime.

How bad was the damage?

It was not immediately clear to what extent traders using the popular prediction market platform were impacted, or the breadth of the impact. The company said anyone who was impacted "will be made whole."

That commitment covers an unknown number of traders on the international platform. Polymarket did not quantify the losses or name the affected markets in its statements.

What happens next?

The referral to UK law enforcement signals the incident has moved from internal remediation to formal investigation. DebugBear's advice to remove embed code suggests its other clients could still be exposed until the vendor resolves the ongoing security incident.

For Polymarket, the reimbursement pledge and the one-hour pause show a platform moving fast to contain reputational risk — but the scope of trader losses, and whether DebugBear's breach touches other sites, remains the open question.