Skip to content

Which companies just had a verified incident, who lends to them and who owns them. Every claim carries its evidence level and its source. How we decide what is confirmed

Global Financial Service Disruptions

Polymarket

fintech · US · North America · Polymarket International platform

Confirmed cyberStatus: resolvedTier 1Severity 2 of 5Evidence confidence: highAnalyst-verified

On 29 Oct 2026 Polymarket placed its international exchange in cancel-only mode and paused relayer actions after attackers drained about USD 2.6M from user accounts through a compromised third-party provider. It later said it was back online and would fully reimburse affected traders.

First disruption
Oct 29
First public signal
Oct 29 (Polymarket posts on X)
Acknowledged
Oct 29
Restored
Oct 29
Duration
not established
DFX first recorded
Nov 5 14:58 UTC

What was restricted

tradingScope: institution wide

Exchange in cancel-only mode (no new orders or trades), relayer actions paused; user funds drained via session hijack; full reimbursement promised.

Financial impact: USD 2.5M to 2.65M drained (The Block, Arkham); not confirmed by Polymarket

Cause, kept in separate layers

What the institution said
One of our third party providers was compromised
DFX classification
Confirmed cyber (cyber: confirmed)
Wording used
We're still looking into this, cancel-only mode, Relayer actions are paused while we investigate
Conflicting reports
Crypto-settled prediction market; may also be recorded by the crypto lane. Vendor named as DebugBear in other press (DFX register lead), not confirmed by Polymarket.

Evidence