Polymarket account hacked? Here’s what to do
Move fast and in the right order: reclaim the account through Polymarket’s official flow, kick the attacker out of every session, then close the door they came through — usually a password that leaked in a breach and was reused.
Polymarket accounts were drained on 29 October 2026. Expect fake “reimbursement” messages next
On 29 October 2026 attackers emptied several hundred Polymarket accounts through a compromised script from one of the site’s outside vendors, and Polymarket put trading into cancel-only mode for about an hour. Polymarket says it will make affected users whole and has referred the case to law enforcement. The follow-up wave is the part that reaches everyone else: emails, DMs and posts promising a “Polymarket refund”, a “compensation claim” or a wallet “re-verification”. Do not connect your wallet or sign anything from a link. Check your account and any notice about repayment by opening polymarket.com yourself.
Polymarket’s statements of 29 October 2026 as reported by CoinDesk, Cointelegraph and The Defiant (29–30 October 2026).
If your Polymarket account was hacked: start recovery at the official page (help.polymarket.com/en/), change the password to a unique one, sign out all other sessions, and re-check the recovery email and phone on the account. Then find out how the attacker got in — check whether your password appears in known breach data — and turn on two-factor authentication so it can’t happen again.
Recover your Polymarket account, step by step
These steps follow Polymarket’s official process — expect it to take checking your wallet takes minutes; reimbursement for affected accounts is handled by Polymarket and can take days to weeks. Official links only: account recovery.
Open polymarket.com yourself (not from a link) and check your balance, open positions and activity history. Compare withdrawals and transfers with what you actually did around 29 October 2026.
If you use an external wallet, open it directly and review recent transactions and token approvals. Revoke anything unfamiliar, and if you signed an unexpected transaction, move the remaining funds to a newly created wallet.
Secure the email account tied to Polymarket: a unique password, an authenticator app or passkey for 2FA, and sign out of sessions you do not recognise. Email access is often how a crypto account is taken over later.
Report unauthorised withdrawals through the Polymarket Help Center, with times, amounts and transaction hashes, and ignore anyone who contacts you first on Discord, Telegram or X claiming to be Polymarket support.
If crypto was stolen, also file reports at ic3.gov and reportfraud.ftc.gov, and treat every “crypto recovery service” that asks for an upfront payment as a second scam.
What trips people up with Polymarket
- The October 2026 losses came from a poisoned script running inside Polymarket’s own website, so a careful user could still be hit. Changing your password does not undo that; what matters is checking your wallet activity and any token approvals made around 29 October.
- After a headline hack, the refund scam is the bigger risk for everyone who was not drained. Messages that ask you to connect a wallet, sign a transaction or pay a “release fee” to receive your Polymarket compensation are theft attempts, even when they quote your real username.
- Polymarket balances sit in an on-chain wallet on Polygon. Stolen crypto cannot be charged back like a card payment, and nobody can “recover” it for an upfront fee. Write down transaction hashes early, because Polymarket and law enforcement will ask for them.
- If you sign in with an external wallet such as MetaMask, the approvals you granted live in that wallet, not in your Polymarket account. Review and revoke any approval you do not recognise, and move funds to a fresh wallet if you signed something unexpected during the incident window.
Was Polymarket hacked? What happened in October 2026
Yes, though not through its smart contracts. On 29 October 2026 money began leaving user accounts on Polymarket’s international platform, and by early afternoon US Eastern time the exchange had switched to cancel-only mode and paused relayer actions. Its status page marked the incident resolved at 3:05 p.m. ET. Press estimates of the loss run from about $2.6 million to $2.7 million across roughly 700 to 740 accounts; Polymarket has not published a final figure.
Polymarket said one of its third-party providers was compromised and described the provider as UK-based. The Wall Street Journal and security researchers at Hudson Rock pointed to a script served from the website-monitoring service DebugBear; Polymarket itself has not named the vendor. It was the second incident of this kind in a few months: in June 2026 a compromised front-end vendor led to losses of about $3 million, which Polymarket also promised to repay.
Polymarket pledged to make affected users whole. Press reports in early November said repayments had started, with smaller losses (reportedly under $10,000) paid directly and larger ones requiring a signed release form, whose terms some traders criticised. Anyone actually affected should hear about repayment inside their Polymarket account or from Polymarket’s official channels, not from a stranger who found them first.
Still logged in? Lock the account down now
If you can still get in, you're racing the attacker. In this order: change the password to a long, unique one; sign out all other sessions/devices (the setting exists in Polymarket's security settings); confirm the recovery email and phone number are yours (attackers quietly add their own so they can "recover" the account later); remove unfamiliar linked apps or API access; and turn on two-factor authentication. Only then deal with anything the attacker posted, sent or bought.
Got a "new login" alert from Polymarket?
Treat it as real but verify it the safe way: never tap the link in the message itself (fake login alerts are a top phishing template for Polymarket). Open the app or type the address yourself, check the active-sessions list in security settings, and if you see a device or location you don't recognize, sign it out and change your password immediately. If the alert was genuine, that password is burned — assume it's circulating and change it everywhere else you reused it.
The attacker spent, moved or stole money
Report the unauthorized transactions to Polymarket through the official flow the moment you're back in (or even before — fraud reports don't require account access). U.S. consumer protections for electronic transfers generally limit your liability the faster you report, so speed matters more than completeness. Also call the bank or card issuer behind the funding source — they can dispute, reverse or block further charges — and file at reportfraud.ftc.gov so the pattern is on record.
Why this happened — and how to make sure it can’t again
About a third of account takeovers are credential stuffing: a password you used on Polymarket (or the email behind it) leaked in some other company’s breach, and attackers replayed it here automatically. The FBI’s IC3 logged over 5,100 account-takeover complaints with $262M in losses in 2025 alone (IC3). Even when Polymarket itself was never breached, your reused password from another site opens it.
So after recovery, check what’s already out there: our free scanner shows which known breaches and dark-web dumps include your email — and whether passwords were exposed with it.
Check my exposure — free →After you recover: three doors to close
- Unique password + 2FA. A password manager plus app-based two-factor stops both stuffing and phishing replays.
- Reset everywhere you reused that password — email first (it’s the master key), then bank, then the rest.
- Shrink your public footprint. Attackers research targets on data-broker sites (your address, phone, relatives — enough to social-engineer support lines). Our free opt-out guide covers 190 of them, step by step.
Hacked Polymarket account, answered
How did my Polymarket account get hacked?
The most common cause isn't a hack of Polymarket itself — it's credential stuffing: a password you used on Polymarket leaked from some other site's breach, and attackers tried it here automatically. Roughly a third of account takeovers happen this way, with phishing (fake Polymarket login pages and alerts) close behind. That's why the first fix is a unique password, not just a new one.
Can I get my Polymarket account back?
Usually yes. Use the official recovery flow (https://help.polymarket.com/en/) — it can verify you even when the attacker changed the email and password. Expect it to take checking your wallet takes minutes; reimbursement for affected accounts is handled by Polymarket and can take days to weeks; respond quickly to follow-ups so the case stays open.
Should I just make a new Polymarket account instead?
Not until you've tried recovery. The old account keeps your history and contacts — and while the attacker controls it, it will be used to scam people who trust you. Recover it, or at minimum report it as compromised so Polymarket can lock it, before you start over.
Will I get money back that was stolen through my Polymarket account?
Often, if you move fast. Report the unauthorized activity to Polymarket and to the bank or card behind it — U.S. protections for unauthorized electronic transfers generally limit your losses the sooner you report. Peer-to-peer payments you were tricked into sending yourself are much harder to recover than transactions the attacker made — another reason to report the takeover itself, with evidence.
Is Polymarket safe to use after the hack?
Polymarket says the October 2026 breach came through a third-party provider rather than its contracts, that the issue was resolved the same day, and that affected users will be repaid. It was still the second vendor-related loss in 2026, so whether to keep funds there is your call. The part you control is your wallet hygiene: few approvals, a separate wallet for trading, and a secured email account.
How do I know if my Polymarket account was affected?
Check your activity history and your wallet’s transactions for withdrawals you did not make on or around 29 October 2026. Polymarket says it is contacting affected users about repayment. If your history matches what you did, your funds were not drained in this incident.
Will Polymarket refund the stolen money?
Polymarket has pledged to make affected users whole. Press reports say smaller losses are being repaid directly and larger ones require signing a release form. Repayment comes from Polymarket itself, and no legitimate repayment asks you to connect a wallet on another site or pay a fee first.
I got a message about a Polymarket compensation claim. Is it real?
Treat it as phishing unless you can see the same notice after logging in to polymarket.com directly. Fake claim pages are built to make you sign a wallet approval that drains you a second time. Do not click, do not connect your wallet, and report the message to Polymarket through its Help Center.
How do I stop my Polymarket account being hacked again?
Three things close most of the doors: a unique password (a manager makes this painless), app-based two-factor authentication, and shrinking your exposed footprint — checking your email against known breach databases and removing your personal data from data-broker sites that attackers use to research targets.