Polymarket Hack: Trading Resumes After Multi-Million Crypto Theft

Crypto prediction platform Polymarket experienced a turbulent day on 29 October when unauthorized withdrawals from user wallets forced the company to temporarily suspend trading. The incident occurred during a critical period, just days before the US midterm elections, a time when trading volume on such platforms typically surges. Following a pause of approximately one hour, operations resumed around 3 p.m. Eastern Time after the security issue was identified and resolved.

According to official statements, only Polymarket's international platform was affected. The company stated that its separate US platform remained secure. However, the incident once again highlights the technical dependencies on third-party providers within the Web3 ecosystem. Polymarket attributed the security breach to an external provider responsible for website performance monitoring.

Numbers and facts

Initial estimates from blockchain analytics firms Betting Intelligence and Polysights suggest that at least €2.43 million ($2.7 million) was stolen from a total of 710 different wallets. While these figures have not been officially confirmed by Polymarket, they align with reports from CNBC. The operator reacted swiftly, identifying the UK-based provider DebugBear as the source of the issue. DebugBear acknowledged the incident and advised its customers to remove the relevant embed code from their websites.

Polymarket has already presented a reimbursement plan for the victims. Users with losses below €8,985 ($10,000) were expected to have their funds restored by 30 October. Customers with larger losses are required to sign a release form before the refund process begins. The company also emphasized its cooperation with authorities:

"Polymarket said it had referred the matter to UK law enforcement." - Polymarket spokesperson via CNBC

Background

The situation for Polymarket in Europe is already tense. While the platform continues to grow internationally, it is increasingly being targeted by regulatory authorities. The French regulator ANJ (Autorité Nationale des Jeux) ordered the blocking of the platform in July 2026, citing the illegal offering of gambling services without a license. According to the ANJ, the site recorded 205,057 unique visitors in June alone. Additionally, the European Securities and Markets Authority (ESMA) has clarified that binary prediction markets often qualify as financial instruments and are subject to strict EU directives such as MiFID II.

The legal landscape in the US is equally complex. While providers like Kalshi celebrated partial victories through court rulings in New Jersey, tribal gaming associations (IGA) view these platforms as a threat to their sovereignty. IGA Chairman David Bean warned in San Diego that legal rulings would take precedence over public opinion in this matter.

Why it matters for German players

For German players, using platforms like Polymarket involves significant legal and financial risks. Since Polymarket does not hold a license from the Joint Gambling Authority of the States (GGL), its services are considered illegal gambling under the State Treaty on Gambling 2021 (GlüStV 2021). German players enjoy no protection from the central OASIS exclusion system or the LUGAS monitoring database.

Furthermore, strict German player protection measures, such as the monthly deposit limit of €1,000 or the €1 per spin limit for slots, do not apply to such crypto platforms. The current hack drastically demonstrates that the security of funds is not guaranteed with unregulated providers. In the event of a total loss due to a hack, German users have little to no legal recourse, as they were operating on a platform not permitted in Germany.

What it means for GGL-licensed casinos

For licensed German online casinos, this incident underscores the importance of strict regulation and IT security. GGL-licensed operators must meet the highest standards of data security and undergo regular audits. A hack of this nature, where millions are drained via third-party scripts, would be much harder to execute in the highly regulated German market due to strict infrastructure requirements. Additionally, the GGL whitelist provides players with the certainty that they are playing with reputable companies that can be held liable. The Polymarket case serves as a cautionary tale of why licensed providers are the safer path despite stricter limits.