Polymarket Hack Linked to Third-Party Code Drains $2.7m
A breach of website monitoring software supplied by UK firm DebugBear let attackers raid logged-in Polymarket accounts, prompting a trading halt and reimbursement pledge.
Polymarket has pledged to reimburse traders after an estimated $2.7 million was drained from hundreds of accounts on its international platform on Thursday 29 October, according to Casino.org News.
Blockchain analytics firm Bubblemaps put the number of affected users at around 700. Polymarket has not confirmed how many customers were hit or how much was taken, but said it had fixed the underlying issue and would make victims whole.
The breach struck Polymarket.com, the company's cryptocurrency-based exchange operating internationally, and did not touch Polymarket US, which runs separately under US financial regulation.
Security researchers traced the attack to tampered JavaScript code sitting on infrastructure belonging to DebugBear, a British company that supplies tools for monitoring how websites perform. The malicious code ran automatically when traders visited the legitimate site, meaning victims did not need to click a phishing link or hand over a password to lose funds.
Cybersecurity firm Hudson Rock identified the modified script, which exploited traders' existing logged-in sessions. Analysis by BleepingComputer found the code examined a user's crypto balance and any live positions on the prediction market, then tried to liquidate those holdings or move the assets out to a wallet the attackers controlled.
BleepingComputer also traced roughly $2.57 million in Polygon's POL cryptocurrency moving from a suspected attacker wallet to three further addresses.
DebugBear acknowledged an ongoing security incident and told customers using its Real User Monitoring product to strip the embedded code from their sites. It has not said publicly how its own systems were compromised.
Polymarket put its exchange into cancel-only mode at 2:05pm Eastern on Thursday, blocking new trades while still allowing existing orders to be cancelled, before restoring normal trading around 3:05pm, according to the company's status page.
"One of our third party providers was compromised," Polymarket said, adding that it had referred the matter to UK law enforcement.
The company later confirmed trading was fully restored and said it would cover losses. CNBC reported that Polymarket messaged users on Discord promising that anyone short by under $10,000 would see their money back by Friday 30 October, while larger claims would need a signed release agreement first.
It is the second time in months that a third-party compromise has hit Polymarket. CoinDesk reported that a separate breach in June resulted in roughly $3 million being stolen from users.