Polymarket suspended trading on its international platform, Polymarket.com, on October 29 after users reported unauthorized withdrawals from their accounts. The prediction market first moved the platform into cancel-only mode and suspended relayer actions before restoring normal trading about an hour later.
Polymarket said a third-party provider had been compromised and that the issue has since been fixed. The company referred the incident to law enforcement and pledged to make whole any affected traders, though it has not named the vendor or disclosed total losses. Polymarket’s US platform was reportedly not affected.
Researchers tied the breach to malicious JavaScript served through DebugBear, a UK-based website performance monitoring firm. DebugBear confirmed it was hit by an ongoing security incident, urged customers using its real user monitoring (RUM) snippet to remove it from their sites, and said it has engaged incident response specialists.
How the Attack Worked
Threat intelligence firm Hudson Rock obtained a copy of the malicious code from a DebugBear address used by Polymarket. The script scanned for a logged-in user’s trading tools and portfolio, then attempted to sell positions and redirect proceeds, or send position tokens directly to an attacker-controlled address, depending on account type.
Hudson Rock said the script did not appear to exfiltrate credentials, passwords, seed phrases, or private keys. Instead, it abused the authority already granted to an authenticated session. The firm also identified a Polymarket production build timestamped 17:59 UTC with a change log entry noting removal of the DebugBear script.
Loss Estimates Vary
Figures on the damage differ across researchers. Hudson Rock reviewed a screenshot showing roughly $2.19 million at the script’s hard-coded fallback address, though it cautioned this is not a verified total. Blockchain security firm GoPlus, which independently attributed the attack to the same DebugBear supply chain compromise, estimated losses at approximately $2.71 million, tracing the attack path through 710 deposit wallets and 731 addresses. Arkham data showed a suspected attacker wallet holding about $2.65 million, matching the fallback address hardcoded in the script.
Hudson Rock has not determined how the script was tampered with or how many users were affected, and found no evidence other DebugBear customers were targeted. The incident follows a similar frontend script injection Polymarket disclosed in June, which resulted in roughly $3 million in losses.
