Polymarket restores trading after one-hour outage and pledges to make affected users whole

Polymarket restored trading on its international platform Thursday after a one-hour major outage involving a compromised third-party provider. The company said it had fixed the issue, referred the matter to law enforcement and would make impacted users whole.

Its official incident log records the interruption from 18:05 to 19:05 UTC on October 29, equivalent to 2:05 to 3:05 p.m. in New York. That establishes when its trading service was disrupted, not the total amount of any customer loss.

What the platform’s own timeline says

At 18:05 UTC, the exchange reported cancel-only trading and paused relayer actions while it investigated. At 18:37 it said it had identified and fixed the issue affecting Polymarket.com and that a third-party provider had been compromised.

A notice at 18:55 said trading would resume at approximately 3 p.m. Eastern. The final update marked the incident resolved at 19:05 UTC. The affected component was its Predictions Trading API, also called CLOB.

The distinction between cancel-only and ordinary trading matters for readers who use prediction-market prices as a running measure of sentiment. An interruption prevents a continuous sequence of normal trading. An apparent lack of movement during that interval is not evidence that traders were unconcerned about the underlying event.

The compensation question stays separate

Polymarket’s published assurance covers anyone impacted. The incident log does not put a dollar amount on the damage, list a verified number of affected accounts or give a reimbursement schedule. Reopening trading and completing compensation are separate milestones.

That leaves two different checks for an affected customer: whether the trading service is operational and whether any disputed balance or transaction has been addressed. A green status page answers the first question. It does not establish the second for an individual account.

The risk beyond the trading engine

Website-monitoring provider DebugBear separately reported an ongoing security incident and told customers of its Real User Monitoring product to remove its embedded code. Polymarket’s own incident page does not name the compromised provider. The two statements do not, on their own, provide a complete public forensic account.

The broader business issue is the code a website loads from suppliers. Mozilla’s security documentation describes how reliance on third-party JavaScript increases the difficulty of controlling the sources of code running on a site. Its guidance recommends a strict Content Security Policy as part of a wider defense, with report-only testing before enforcement.

That is relevant to shops and subscription businesses as well as crypto platforms. A vendor added to measure website performance still belongs in the inventory of software that runs on the customer-facing page. This incident does not prove that any particular security header would have prevented it; that would require evidence about the actual compromise and defenses.

The next substantive update will be an account of the cause and scope, followed by details of compensation. A single official timeline is already enough to distinguish the service outage from claims about losses that the platform has not quantified.

Sources: Polymarket’s official incident log, DebugBear’s public notice and Mozilla’s Content Security Policy documentation, accessed October 29. No customer loss total has been asserted here. This is market information, not investment advice.