Polymarket Hacked Again: What the $2.7 Million Drain Means for Your Taxes

Polymarket was hacked on October 29, 2026, and about $2.7 million was drained from user accounts. Polymarket says it is refunding every affected trader. If you get all of it back, you have no theft loss to deduct and, in most cases, nothing to report. A tax question only comes up if part of the money is never returned. Then the unreturned part can be a theft loss deduction, but only up to what you put in, only once it’s clear the rest isn’t coming back, and only if you itemize.

What happened in the Polymarket hack

On the afternoon of Thursday, October 29, traders on Polymarket’s international exchange started reporting unauthorized withdrawals. At 2:05 p.m. Eastern, Polymarket put the exchange into cancel-only mode and paused relayer actions, according to a BleepingComputer timeline. Trading came back at about 3 p.m., roughly an hour later.

The code that drained accounts came from a third-party script loaded on Polymarket’s site. A person familiar with the matter told CNBC the source was a hack of DebugBear, a website performance monitoring service. DebugBear said on X that it was “impacted by an ongoing security incident” and told customers of its real user monitoring product to remove its embed code. Polymarket’s own statement said only that “one of our third party providers was compromised.”

Researchers at Hudson Rock took the script apart, as Cyber Kendra reported. It read login details and trading keys that the browser already held, then:

• for accounts connected with a crypto wallet, sent position tokens straight to the attacker;
• for email-login accounts, placed sell orders at lower and lower prices, then tried to move the proceeds out.

Polymarket’s smart contracts weren’t touched. The script used permissions victims’ browsers already had. Polymarket’s U.S. platform, the CFTC-regulated exchange, was not compromised, CNBC reported. Polymarket said the attack appeared to come from the United Kingdom and referred it to British authorities.

How much was stolen?

Polymarket hasn’t published a total or a count of accounts. Three outside estimates landed close together:

• At least $2.7 million withdrawn across 710 wallets, from an analysis by Betting Intelligence and Polysights given to CNBC.
• About $2.65 million, from Arkham data cited by The Block and NBC News.
• About $2.57 million in POL moved out of the attacker’s wallet, by BleepingComputer’s count.

One trader said about $800,000 was taken from his account, and that a friend lost about $600,000 more.

Polymarket hacks in 2026

It’s the second time in 2026 that a compromised third-party script has drained Polymarket users’ accounts.

Sources: Decrypt (May), Cointelegraph and CoinDesk (June), CNBC (October).

Is Polymarket refunding the stolen funds?

Yes, by its own account. “We’ll make this right and are fully reimbursing all affected traders,” Polymarket posted, and its status page said “anyone who has been impacted will be made whole.” It told users on Discord how the refunds work, according to CNBC:

• Less than $10,000 taken: funds restored by October 30.
• More than $10,000 taken: you have to sign a release form to get the money back.

A release generally means you give up further claims over the incident in exchange for the payment. Read it before you sign, and keep a copy with the payment record. Both matter for your taxes, as the next sections show.

Is a Polymarket refund taxable?

Usually not, if it only puts back what was taken. Three cases:

• Full refund, nothing deducted: you’re back where you started. There’s no theft loss, and getting your own money back isn’t income.
• Refund more than your basis: if Polymarket pays back the value of positions that had grown, and that’s more than you paid for them, the difference is a gain. IRS Publication 547 says it directly: “If your reimbursement is more than your adjusted basis in the property, you have a gain.”
• Refund after you deducted the loss: you don’t amend the earlier return. You report the refund as income in the year you receive it, to the extent the deduction cut your tax (Reg. §1.165-1(d)(2)(iii)).

Can you deduct stolen crypto on your taxes?

Sometimes. The IRS’s own lawyers walked through theft losses for scam victims in a March 2025 memo, Chief Counsel Advice 202511015. Three tests come out of it, and all three have to be met:

1. It has to be a theft under the law of your state: an illegal taking. Draining an account with malicious code would normally qualify, but your state’s criminal law decides.
2. The money has to be in a transaction entered into for profit. Since 2018, individuals can’t deduct personal theft losses outside declared disasters, and the 2025 tax law made that limit permanent. A theft of money you held to make a profit is the exception (26 U.S.C. §165(c)(2)). In the memo, victims who lost money they meant to invest could deduct it; victims of a romance scam couldn’t. Money kept on Polymarket to trade looks like the first kind, but it’s a question of your facts.
3. There has to be no reasonable prospect of getting it back. A theft loss counts in the year you discover it, but not while a real claim for recovery is open. A refund promise like Polymarket’s is exactly that kind of claim, so you wait until it’s settled.

If you’re only partly refunded

The regulations say a loss covered by a claim is sustained once you can tell “with reasonable certainty” whether you’ll be paid, for example “by a settlement of the claim, by an adjudication of the claim, or by an abandonment of the claim” (Reg. §1.165-1(d)(2)(i)). A signed release and a final payment is a settlement.

Say $25,000 of money you held to trade was taken, and after you sign the release you’re paid $20,000. The $5,000 that won’t come back can be a theft loss in the year the claim was settled, if the other tests are met. Any part of a loss that was never covered by a claim counts in the year of the theft itself.

How much of a theft loss can you deduct?

Your basis, which is what you put in, not the market value of what was taken. The IRS memo is direct about it: you can’t deduct income or an unrealized gain that you never reported.

• You deposited $5,000 and your open positions grew to $8,000 before they were drained. The theft loss is $5,000. The $3,000 of paper gain was never taxed, so it isn’t deductible either.
• You had already closed trades for a $3,000 profit and kept the $8,000 in cash on the platform. That $3,000 is income you report for the year, so your basis in the cash is the full $8,000.

The $100 and 10%-of-income reductions that shrink theft losses on personal property don’t apply to property held for profit, per Publication 547.

Trades the attacker made in your account

On email-login accounts, the script sold positions before moving the money. Those sales show in your Polymarket history as if you placed them, and they change your gain or loss for the year. The IRS hasn’t said how to treat trades someone else placed in your account without permission. Make a list of every trade and transfer you didn’t make, with times and transaction hashes, and keep it next to Polymarket’s refund record so whoever prepares your return can see both.

Where a theft loss goes on your return

A theft of money held for investment goes on Form 4684, Section B, and from there to Schedule A, line 16. Schedule A means itemizing. If you take the standard deduction, the loss gives you no tax benefit.

What to do if your Polymarket account was hacked

• Take dated screenshots of your balance, positions and history before anything changes.
• Write down your wallet address and the transaction hashes of the transfers out.
• Report it to Polymarket support and keep the ticket number.
• Keep the release form, if you sign one, and the record of every refund payment.
• File a report with the FBI’s Internet Crime Complaint Center and your local police. A report helps show it was a theft.
• Ignore anyone who contacts you offering to recover stolen crypto for a fee. Polymarket’s refunds come from Polymarket, and no one needs your seed phrase or private key to process them.
• Keep the rest of your year’s trades separate from the theft. Your gains and losses from trading are reported under one of the four methods; the theft is its own item.

Outside the US? Theft and refund rules differ by country. Polymarket taxes in the UK, Canada, Australia and India.

Questions about the Polymarket hack and taxes

For the rest of your Polymarket year, WagerMints reads your wallet’s full history, including positions that lost and were never redeemed, and prices it four ways. How Polymarket trades are taxed.