● Covered by 4 sources · 5 reportsMedium impact2 negative3 neutral
Polymarket Halts Trading After Third-Party Breach, $2.5M in Crypto Traced
Key points
- Polymarket halted trading due to a third-party service compromise.
- Malicious JavaScript drained cryptocurrency from user wallets.
- Approximately $2.5 million in POL tokens were traced to an attacker's wallet.
- Polymarket fixed the issue and will reimburse affected traders.
- Polymarket halted trading on October 29.
- The third-party provider compromised was DebugBear.
- Polymarket's US platform was unaffected by the attack.
- DebugBear confirmed a security incident and urged users to remove its snippet.
- Hackers stole approximately $2.7 million from 726 Polymarket traders.
- The malicious script exploited existing user sessions to sell positions and transfer funds.
- Blockchain records show crypto worth about $2.64 million reached the hackers' wallet.
- DebugBear's DNS records were compromised through its domain registrar.
- The attack targeted one customer's website.
- Researchers at Ohey found a different server answering for DebugBear's web addresses at 18:13 UTC.
- Polymarket is returning $3.9 million to traders.
- Polymarket is covering traders hurt by the trading halt or whose positions were sold or transferred, paying out $1.19 million.
- Polymarket is refunding $2.7 million for initial losses and $1.2 million for shutdown-related losses.
- Polymarket identified eligible wallets from on-chain and trading data; no claims are needed.
- 95% of affected wallets were refunded in full by Saturday.
Security Incident and Trading Suspension
Polymarket, a prediction market platform, temporarily suspended trading on Thursday following a security breach. The incident involved the compromise of a third-party provider, which was used to distribute malicious JavaScript designed to steal cryptocurrency from users. The company placed its exchange into cancel-only mode and paused relayer actions during the investigation.
Issue Identified and Resolved
Polymarket confirmed that it identified and fixed the issue affecting its international platform, Polymarket.com. Trading was halted as a precautionary measure. Approximately one hour after the initial suspension, trading resumed, and the company announced the incident was resolved, stating it would fully reimburse all affected traders.
Attacker Wallet and Stolen Funds
Security researchers at Hudson Rock identified a suspected attacker-controlled wallet (0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18) embedded in the malicious JavaScript. Blockchain analysis revealed that this wallet transferred approximately 28.6 million POL tokens, valued at about $2.57 million, to three other wallets. The wallet conducted numerous transactions involving Polymarket's prediction-market token contract shortly before the trading suspension.
Malicious Script Details
The cryptocurrency-draining script was distributed via cdn.debugbear[.]com/C7xcKKrjUnXK.js. This script was hosted on infrastructure belonging to DebugBear, a website performance-monitoring service. The JavaScript was specifically designed to steal cryptocurrency and prediction-market holdings from Polymarket users.
Company Response and Next Steps
Polymarket has referred the breach to law enforcement. While the company confirmed reimbursements, it has not yet disclosed the number of affected users, the total amount of cryptocurrency stolen, or the specifics of the reimbursement process. The company's immediate focus was on restoring platform functionality and securing user assets.
Updates
- Polymarket is refunding $2.7 million for initial losses and $1.2 million for shutdown-related losses.
- Polymarket identified eligible wallets from on-chain and trading data; no claims are needed.
- 95% of affected wallets were refunded in full by Saturday.
- Polymarket is returning $3.9 million to traders.
- Polymarket is covering traders hurt by the trading halt or whose positions were sold or transferred, paying out $1.19 million.
- Hackers stole approximately $2.7 million from 726 Polymarket traders.
- The malicious script exploited existing user sessions to sell positions and transfer funds.
- Blockchain records show crypto worth about $2.64 million reached the hackers' wallet.
- DebugBear's DNS records were compromised through its domain registrar.
- The attack targeted one customer's website.
- Researchers at Ohey found a different server answering for DebugBear's web addresses at 18:13 UTC.
- Polymarket halted trading on October 29.
- The third-party provider compromised was DebugBear.
- Polymarket's US platform was unaffected by the attack.
- DebugBear confirmed a security incident and urged users to remove its snippet.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
Polymarket will refund $3.9 million to users affected by a recent site compromise that allowed an attacker to steal funds. The compromise occurred through a third-party performance monitoring vendor, DebugBear, which had its script replaced with malicious code.
Polymarket is returning $3.9 million to traders following a supply chain attack that led to unauthorized withdrawals from 726 wallets. The incident involved a malicious JavaScript served from DebugBear, which has since disclosed its DNS records were compromised via its domain registrar.
Hackers stole approximately $2.7 million from 726 Polymarket traders by replacing a legitimate DebugBear page-speed script with malicious code on Polymarket's website. The malicious script exploited existing user sessions to sell positions and transfer funds, prompting Polymarket to issue refunds.
Polymarket halted trading on its international platform after a supply chain attack on a third-party provider, DebugBear, led to unauthorized withdrawals totaling over $2 million. Malicious JavaScript injected through DebugBear's monitoring script allowed attackers to drain funds from user accounts by selling positions or directly transferring tokens. Polymarket has pledged to reimburse all affected traders.
Prediction market platform Polymarket temporarily suspended trading after a third-party service compromise led to the distribution of crypto-draining JavaScript. Approximately $2.5 million in assets were traced to a suspected attacker's wallet, and Polymarket has stated it will reimburse all affected users.