Polymarket · Breach

Polymarket to Return $3.9 Million After DebugBear Supply Chain Attack

· 3 min read

A DebugBear monitoring script loaded by polymarket.com was swapped for code that sold positions and drained funds from logged-in traders on October 29; DebugBear blames a DNS hijack through its domain registrar. In a post-mortem, Polymarket committed $3.9 million ($2.7 million stolen plus $1.2 million for the outage) and says 95% of affected wallets were already refunded. Refunds are automatic, no claims needed; users disputing the numbers should contact official channels.

By Updated Get this every day →← Back to the feed 17 sources
WhatsApp LinkedIn X
HighBreachNo software to update
In this article
  1. What happened
  2. Why it matters
  3. What to do
  4. For the technical team
  5. Timeline
  6. Sources

What happened

Prediction market Polymarket suffered a supply chain attack on October 29: a script from vendor DebugBear was swapped for code that sold positions and drained funds from logged-in users. In a post-mortem, the company committed to returning $3.9 million; 95% of affected wallets were refunded as of Saturday. Trading was paused and resumed, and law enforcement was engaged.

Incidents like this, every morning

The ones that need action first, in a 3-minute read.

Free · 1 email a day, in the morning · no spam, unsubscribe in 1 click

Why it matters

About $2.7 million was stolen from 726 wallets, and the hours-long shutdown added losses covered by $1.19 million across roughly 5,500 wallets. It is the second similar incident this year: in June, a third-party compromise injected a malicious script into the frontend, with losses of about $3 million. Third-party scripts on financial websites put customer money directly at risk.

What to do

Users who traded on October 29 should watch official channels: refunds are automatic, no claims needed, and disputes should go to Polymarket. Companies running third-party scripts should review integrity controls and add continuous monitoring.

For the technical team

Affected
Polymarket, plataforma de mercado de previsões; frontend web e carteiras de usuários; vetor atribuído a sequestro de DNS na DebugBear · polymarket.com (international platform); the US platform was reportedly unaffected, per SecurityWeek. DebugBear urged customers of its RUM product to pull the snippet from their websites.
Exploitation
Executed October 29. Hudson Rock reported about $2.19 million at the hard-coded fallback address (unverified tally); GoPlus estimated roughly $2.71 million; Arkham showed a suspected attacker wallet holding about $2.65 million. Polymarket counted 726 affected wallets. Attacker not identified.
Fix
No software patch required. Polymarket removed the script within the hour, paused trading, reset all active login sessions, and redeployed the vendor script with additional integrity controls and continuous monitoring and verification.
Vector
DebugBear real user monitoring (RUM) JavaScript loaded by polymarket.com was replaced with wallet-draining code. It exploited authenticated sessions of logged-in traders: it checked portfolios and either dumped positions or sent assets to an attacker-chosen address. DebugBear attributes the swap to its DNS server records being compromised through its domain registrar; it says there is no indication its internal systems were compromised.
More details
The script read credential-related browser data, but Hudson Rock found no routine sending passwords, seed phrases or private keys to the attacker; it reused the trading permissions of the open session. A Polymarket production build timestamped 17:59 UTC removed the DebugBear script. In an October 30 update, all but 37 of the 726 wallets had been made whole. GoPlus traced the main attack path through 710 deposit wallets and 731 addresses. DebugBear says one customer's website was specifically targeted (preliminary finding) and it currently cannot receive email at its domain. Second similar Polymarket incident; the June compromise caused about $3 million in losses. Law enforcement engaged and an internal investigation is ongoing.

Timeline

  1. Polymarket publishes a post-mortem, pledging to return $3.9 million and compensate for the site's downtime.

  2. Refunds rise to $3.9 million; DebugBear blames a DNS hijack via its domain registrar and says a single customer was targeted.

  3. Polymarket says it will refund about $2.7 million to 726 affected wallets; blockchain records show $2.64 million reached the attackers.

Want the next updates in your inbox? Get the daily edition →

See all 18 updates

  1. Polymarket officially confirms the outages stemmed from a compromise of an unnamed third-party provider.

  2. Hudson Rock analysis details the DebugBear-hosted script carried wallet-draining code aimed at logged-in trading sessions; Polymarket's status page confirms a third-party provider was compromised and marks the incident resolved at 3:05 PM ET.

  3. SecurityWeek details the attack mechanism: malicious code tied to a website monitoring tool hijacked logged-in Polymarket sessions to drain funds, with losses above $2 million.

  4. WSJ reports at least $2.6 million in user funds drained after hackers exploited an engineering flaw in the website.

  5. New X post repeats the claim that Polymarket was hacked, with no additional details.

  6. This batch detailed the attack vector: a third-party DebugBear script was swapped for a wallet drainer that withdrew funds through the platform itself, with trading limited to cancel-only mode.

  7. Tracing links about $2.5 million to a suspected attacker wallet; the malicious script hijacked authenticated sessions to sell positions and steal assets.

  8. New posts on X repeat the claim that millions of dollars were stolen from the platform.

  9. The international trading platform was halted because of the compromise; users report losing funds.

  10. Early vxunderground report attributes the attack to an unknown threat actor and points to millions of dollars stolen within the past hour.

  11. Polymarket confirms a third-party provider was compromised, says it referred the matter to authorities, and pledges to reimburse users hit by unauthorized withdrawals.

  12. vxunderground claims over 1,000,000 users were cryptodrained in about an hour.

  13. Polymarket blamed the incident on a vulnerability in an external authentication provider and says the issue has been resolved.

  14. Platform confirms incident and halts trading; users report unauthorized withdrawals of up to $800,000 each.

  15. Incident opened.

Sources 17 sources

See all 21 sources

Get the next one tomorrow morning

One email a day with what changed, what to fix first and how. After signing up you get the full feed.

Free · 1 email a day, in the morning · no spam, unsubscribe in 1 click

Share it with your team

Whoever handles security with you should get it too.

LinkedIn X

Your colleague gets a confirmation request. Nothing is sent unless they confirm.

See all news

Read also

Before you go: get this every day

The HIFY Radar daily edition lands every morning with the incidents that need action. Free.

Free · 1 email a day, in the morning · no spam, unsubscribe in 1 click