Is Polymarket legal in India? No. The prediction market is blocked under Section 69A of the IT Act, and the ministry of electronics and IT (MeitY) treats prediction markets as online money games under the Promotion and Regulation of Online Gaming Act, 2025. This week’s hack adds a second reason to stay away, and it is one most coverage skipped: the money left through a script that had nothing to do with betting or blockchains.
What happened, in IST
On 29 October a real-user monitoring script from DebugBear, a UK website speed-testing service that Polymarket embedded on its site, was swapped for a wallet drainer. According to a technical write-up of the drainer, it reused Polymarket’s own trading client inside the page, signed transfers with each account’s existing signer and pushed them through Polymarket’s own relayer. No smart contract was broken.
| Time (IST) | Event |
|---|---|
| 29 Oct, 10:24 PM | DebugBear’s script origin goes down; the malicious file starts running in logged-in sessions |
| 29 Oct, 10:40 PM | First funds reach the attacker’s Polygon wallet |
| 29 Oct, 11:29 PM | Polymarket ships a build without the script |
| 30 Oct, 12:08 AM | Attacker has forwarded the stolen POL to three other wallets |
| 30 Oct, about 12:35 AM | Trading fully back online (BleepingComputer reports 3:05 PM ET) |
Polymarket says it is returning $3.9 million: the $2.7 million taken plus $1.19 million for about 5,500 wallets that lost out during the pause, per Bankless. CNBC reported that 95% of affected wallets had been refunded by Friday, and that larger victims must sign a release form first. Bankless notes this is the second time since June that a compromised vendor injected code into Polymarket’s site.
The numbers in rupees
At ₹94.9 per US dollar:
| Figure | US$ | Approx. ₹ |
|---|---|---|
| Total drained (726 wallets) | 2.7 million | ₹25.6 crore |
| Extra paid for pause losses | 1.19 million | ₹11.3 crore |
| Total being returned | 3.9 million | ₹37.0 crore |
| Median victim’s loss (Bitquery, via Bankless) | 171 | ₹16,200 |
| Average loss per drained wallet (our math) | about 3,720 | about ₹3.5 lakh |
The gap between the median (₹16,200) and the average (₹3.5 lakh) tells the story: most victims were small, but four accounts that each lost more than $100,000 made up 43% of the haul.
What it means for Indian investors
- There is no legal door in. MeitY’s April 2026 advisory named Polymarket, told VPN providers not to enable access, and specifically flagged users converting rupees into USDC to play. Polymarket’s X account was also withheld in India this month.
- The Act’s penalties target operators and enablers. Offering an online money game can mean up to three years in prison or a ₹1 crore fine, advertising one up to two years or ₹50 lakh, and banks and payment firms are barred from moving money for them. An Indian user reaching the site through a VPN is still using a service the law says should not exist here.
- The refund came from goodwill, not a regulator. No Indian body supervises Polymarket, so an Indian victim’s only route is the platform’s own terms, including the release form.
- Losses don’t help your tax bill. India gives no tax loss for crypto taken in a hack, as we explained earlier this week.
If you hold USDC or USDT for other reasons, check what it is worth in rupees with our USDT to INR converter, and use the FIU-IND registered exchange checker before sending funds anywhere.
BtcMedia verdict
The lesson travels beyond Polymarket. Any crypto site that loads outside scripts next to a logged-in wallet carries the same exposure, and a “secure” smart contract does not protect a hijacked browser session. For Indian users, Polymarket combines that risk with a blocked platform and no local recourse.
FAQ
Is Polymarket legal in India? No. It is blocked under Section 69A of the IT Act, and MeitY treats prediction markets as prohibited online money games under the 2025 Act.
Was Polymarket’s blockchain hacked? No. A third-party speed-monitoring script on its website was replaced with a drainer that used logged-in sessions to move funds.
Did victims get their money back? Polymarket says it is returning $3.9 million in total, and CNBC reported 95% of affected wallets were refunded by 30 October.
How we calculated this: dollar figures from Polymarket via Bankless and CNBC, timeline from the ohey.ca analysis converted from UTC to IST (+5:30), rupee figures at ₹94.9 per US dollar, checked 31 October 2026, 8:50 PM IST. This is not financial or legal advice.