Polymarket Halts Trading After Third-Party Breach Drains Funds
Prediction market platform Polymarket temporarily suspended trading after hackers compromised a third-party service to distribute cryptocurrency-draining JavaScript, leading to millions in traced assets and a pledge to reimburse affected traders.
Radwan AbdulhadiEditor and technology writer
Trading Suspended Following Third-Party Vendor Compromise
Prediction market platform Polymarket temporarily suspended trading on Thursday after hackers compromised a third-party service to distribute cryptocurrency-draining JavaScript, with approximately $2.5 million in assets traced to a suspected attacker wallet. The company confirmed the security incident, saying it had identified and fixed the issue affecting its international platform, Polymarket.com, and referred the breach to law enforcement.
Trading has resumed on Polymarket’s flagship international platform after a hack that drained money from the wallets of some traders. A third-party vendor based in the United Kingdom was breached, not the prediction market’s website itself. Law enforcement in the UK have been notified of the incident, the company said, while trading was initially paused while the platform investigated for several hours.
Polymarket initially placed its exchange into cancel-only mode at 2:05 p.m. ET and paused relayer actions while investigating the incident. At 2:37 p.m., the company announced that the issue had been fixed and that trading was temporarily halted out of an abundance of caution. Trading resumed approximately one hour after the initial suspension, with the incident marked resolved at 3:05 p.m. ET.
Malicious Script and DebugBear Infrastructure Involvement
Security researchers at Hudson Rock identified malicious JavaScript distributed through cdn.debugbear[.]com/C7xcKKrjUnXK.js that was designed to steal cryptocurrency and prediction-market holdings from Polymarket users. The script was hosted on infrastructure belonging to DebugBear, a website performance-monitoring service that helps organizations track website loading speeds and user experience. DebugBear's Real User Monitoring (RUM) service uses JavaScript embedded in websites to collect performance metrics from visitors' browsers.
DebugBear has since confirmed that it is investigating an ongoing security incident and warned customers to remove its monitoring JavaScript from their websites. Hudson Rock's researchers also discovered Polymarket production build metadata containing the commit message indicating that the platform had removed the DebugBear monitoring integration. The build was timestamped October 29 at 1:59 p.m. ET, shortly before Polymarket publicly announced the incident.
BleepingComputer analyzed a copy of the malicious JavaScript file, finding that it was designed to hijack authenticated Polymarket trading sessions, liquidate users' prediction-market positions, and transfer cryptocurrency and other assets to an attacker-controlled wallet. The malware checks whether a visitor is logged into Polymarket and attempts to use their existing trading session and the platform's trading functionality to carry out unauthorized transactions.
Tracing the Stolen Cryptocurrency and Attacker Wallets
Security researchers at Hudson Rock identified a suspected attacker-controlled wallet embedded in the malicious JavaScript. BleepingComputer's examination of the wallet's blockchain activity found that it transferred approximately 28.6 million POL, valued at roughly $2.57 million, to three additional wallets. Blockchain records also show that the wallet conducted numerous transactions involving Polymarket's prediction-market token contract between 1:50 p.m. and 1:56 p.m. ET, shortly before the exchange suspended trading.
On X, prominent traders complained that they had lost money; blockchain analytics firm Bubblemaps reported that around 700 users appeared to have been affected, with approximately $2.7 million stolen. Polymarket declined to comment when asked how many traders were impacted by the breach and how much money was lost, but the company stated that it will refund impacted traders.
Company Response and Full Trader Reimbursements
Polymarket emphasized its commitment to making affected users whole following the containment of the security incident. "Trading is now fully back online," the company announced on X. "We'll make this right and are fully reimbursing all affected traders." Polymarket has not disclosed how many users were affected, how much cryptocurrency was stolen, or how the reimbursement process will work in detail beyond the public assurance.
The hack did not impact users on Polymarket US, the company’s newer platform for people within the United States. Polymarket runs two separate prediction markets; Polymarket US operates as a federally regulated financial exchange within the country, while the flagship Polymarket platform is a cryptocurrency-based service that remains banned in the United States and several other international jurisdictions.
Broader Context and Prior Platform Security Issues
This incident marks another hurdle for Polymarket, which has experienced security challenges in the past. In June 2026, the prediction market encountered another breach that resulted in over $2 million in losses for impacted traders. Despite these setbacks, the company has continued to expand rapidly, securing significant financial backing and high-profile attention across global financial markets.
The platform has been a focal point for various high-profile events and controversies since its 2020 launch, including major fundraising milestones. Security analysts note that credential security and third-party vendor management remain critical attack vectors for decentralized finance and web-based prediction exchanges operating at scale.
Sources
- BleepingComputerPolymarket halts trading after crypto-draining script breach, $2.5M traced
- WIREDPolymarket Halted International Trading After Hackers Drained Accounts
Continue chronologically
Related stories
Polymarket Traders Lose Over $2 Million in Supply Chain Attack
Polymarket temporarily halted trading after a compromised third-party script from DebugBear drained over $2 million from user accounts.
Polymarket Saw $600 Million in Post-Election Trades
Two global election markets on Polymarket generated over $600 million in volume after outcomes were settled, highlighting potential volume manipulation.
Polymarket Lobbies EU Regulators to Reclassify Operations
Polymarket is seeking to be regulated as a financial services provider rather than a gambling platform to bypass strict European restrictions.
Hegseth warns prediction market bets endanger US troops
Defense Secretary Pete Hegseth warns that using nonpublic information for prediction market bets can warp judgment and endanger US troops.
