Polymarket Traders Lose Over $2 Million in Supply Chain Attack
Polymarket temporarily halted trading on its international platform after a third-party script compromise allowed malicious code to siphon funds from user accounts.
Radwan AbdulhadiEditor and technology writer
Trading Halted Due to Third-Party Compromise
Polymarket halted trading on its international platform on October 29 after users reported unauthorized withdrawals. According to the prediction market’s status page, the exchange was first switched to cancel-only mode, with relayer actions suspended. The US platform was reportedly unaffected by the incident.
Addressing the incident, the company said: “We’ve identified & fixed an issue impacting our international platform, Polymarket.com. One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement. Anyone who has been impacted will be made whole.” Trading resumed about an hour later, and Polymarket pledged to reimburse all affected traders, though it did not name the vendor or disclose losses at the time.
DebugBear Confirms Ongoing Security Incident
Researchers quickly linked the theft to malicious code served from DebugBear, a UK-based website performance monitoring firm. DebugBear confirmed being impacted by an ongoing security incident and urged users of its real user monitoring (RUM) product to pull its snippet from their websites. The firm also stated that it brought in specialist incident responders.
Analysis of the Malicious Script
Hudson Rock obtained a copy of the malicious JavaScript from a DebugBear address used by Polymarket. The code hunted for a logged-in user’s trading tools and portfolio. Depending on the account type, it then tried either to sell positions and move the proceeds, or to send position tokens straight to an attacker-set address.
According to Hudson Rock, the sample read credential-related material, but its review did not identify a routine that sends the credential map, a password, a seed phrase, or a private key to its reporting endpoint. Instead, its central approach was to reuse authority already available in the authenticated application. Furthermore, the firm spotted a Polymarket production build, timestamped 17:59 UTC, with a change note about removing the DebugBear script.
Varying Loss Estimates and On-Chain Findings
Loss figures from the supply chain attack vary among security researchers and blockchain analytics firms. A screenshot reviewed by Hudson Rock showed about $2.19 million at the script’s hard-coded fallback address, though the firm noted this is not a verified tally. Meanwhile, blockchain security firm GoPlus attributed the attack to a supply chain compromise of DebugBear’s RUM script and put losses at roughly $2.71 million.
According to GoPlus's on-chain analysis, the main attack path ran through 710 deposit wallets and 731 addresses, though the address count does not equal the total number of victims. Additionally, Arkham data showed a suspected attacker wallet holding approximately $2.65 million, which matches the address hardcoded in the script as its fallback recipient.
Broader Context and Previous Incidents
Hudson Rock has not yet determined how the script was tampered with or precisely how many users were hit, and its findings do not indicate that other DebugBear customers were targeted in the incident. The Polymarket breach occurred on the same day that Binance was hit by a roughly $6 billion hack, which blockchain intelligence firms attributed to North Korea.
This event follows an earlier security issue for the prediction market. In June, Polymarket disclosed another third-party compromise that injected a malicious script into its frontend, resulting in reported losses of around $3 million.
Sources
- SecurityWeek$2 Million+ Drained From Polymarket Traders in New Supply Chain Attack
Continue chronologically
Related stories
Polymarket Halts Trading After Third-Party Breach Drains Funds
Prediction market platform Polymarket temporarily suspended international trading after a third-party vendor breach distributed crypto-draining JavaScript.
Polymarket Saw $600 Million in Post-Election Trades
Two global election markets on Polymarket generated over $600 million in volume after outcomes were settled, highlighting potential volume manipulation.
Polymarket Lobbies EU Regulators to Reclassify Operations
Polymarket is seeking to be regulated as a financial services provider rather than a gambling platform to bypass strict European restrictions.
Hegseth warns prediction market bets endanger US troops
Defense Secretary Pete Hegseth warns that using nonpublic information for prediction market bets can warp judgment and endanger US troops.
