Polymarket, a prediction market where users trade on the outcomes of real-world events, suffered a security breach on October 29 in which attackers drained approximately $2.7 million from hundreds of user wallets after compromising a third-party monitoring service and injecting malicious code into the platform's website.

The attack targeted Polymarket's international trading interface through DebugBear, a website performance monitoring provider whose compromised JavaScript was used to execute unauthorized transactions. Blockchain analysis identified 737 affected accounts with combined losses of approximately $2.73 million, with the funds moved through Polymarket's existing withdrawal infrastructure.

Polymarket temporarily suspended trading, disabled transaction processing and removed the affected integration before restoring operations. The company confirmed the security incident, referred the matter to UK law enforcement and pledged to reimburse all affected traders. The breach did not involve a confirmed vulnerability in Polymarket's smart contracts; instead, it exploited software delivered through a trusted third-party service.

Compromised DebugBear Script Drains Hundreds of Wallets

The attack originated from malicious JavaScript distributed through DebugBear's Real User Monitoring (RUM) infrastructure, a service websites use to track performance and user activity. Security researchers found that the compromised script contained wallet-draining functionality capable of interacting with authenticated Polymarket trading sessions. Once loaded into a user's browser, the malicious code could inspect account balances, identify open positions and initiate unauthorized asset transfers.

Websites routinely load third-party scripts for analytics, advertising and performance monitoring, and any such code executes in the visitor's browser alongside the site's own. When a vendor's script is compromised, the malicious payload can reach every site that embeds it — a pattern commonly described as a software supply chain attack.

The script sought to liquidate prediction market positions and redirect cryptocurrency holdings to an attacker-controlled address, using Polymarket's existing transaction infrastructure. Unlike a conventional smart contract exploit, the attack did not require breaking the underlying blockchain contracts; it abused legitimate trading and withdrawal functions after gaining access through the website's frontend.

DebugBear acknowledged a security incident affecting its infrastructure and urged customers using its monitoring service to remove the embedded JavaScript from their websites. Polymarket subsequently removed the compromised dependency, with its production build showing an update specifically targeting the DebugBear monitoring integration.

The incident closely resembles a June attack that drained approximately $2.94 million from Polymarket users, when another compromised third-party dependency allowed malicious code to reach the platform's frontend. Both incidents underscore how external software integrations can expose user assets even when a platform's core smart contracts remain operational.

Blockchain Analysis Traces $2.73 Million From 737 Accounts

The October 29 transaction trail identified 737 affected Polymarket accounts and approximately $2.73 million in unauthorized withdrawals between 17:10 and 18:10 UTC. Investigators tracked 985 individual draining transactions during that window, with the largest concentration occurring between 17:25 and 18:10 UTC. At peak activity, as many as 40 transactions were recorded within a single minute. Four accounts accounted for roughly 43% of the identified losses, while hundreds of smaller wallets were also affected.

The transfers moved through Polymarket's legitimate relayer infrastructure, which submits transactions on users' behalf, using valid transaction authorizations. The stolen assets were subsequently exchanged for POL, the native cryptocurrency of Polygon — the network hosting Polymarket's trading activity — before being distributed across additional wallets. A principal receiving address, 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18, accumulated approximately 28.6 million POL during the incident.

The attacker later moved funds into three additional wallets, with some assets routed toward Ethereum through cross-chain bridging services. At 19:49 UTC, approximately $2.17 million of the traced funds remained on Polygon, while other proceeds had begun moving across networks.

The on-chain investigation also identified one additional withdrawal worth approximately $11 at 19:11 UTC, after Polymarket had announced that the underlying issue was fixed. The transaction involved an account previously affected by the attack, raising questions about whether all malicious authorizations had been neutralized immediately. Polymarket has not independently confirmed the $2.73 million loss estimate or the reported number of affected accounts.

Polymarket Restores Trading and Promises Full Reimbursements

Polymarket initially moved its international exchange into cancel-only mode at approximately 18:05 UTC, allowing users to cancel existing orders while blocking new trades and pausing relayer operations. The platform identified and removed the compromised integration before announcing at 18:37 UTC that the vulnerability had been addressed. Trading resumed at approximately 19:05 UTC, ending an interruption of roughly one hour. The separate Polymarket US platform was not reported to be affected.

Polymarket has pledged to compensate all affected traders, though it has not disclosed the number of eligible users, a reimbursement timetable or whether any stolen funds have been recovered. The company has also referred the incident to UK law enforcement, where DebugBear is based, as investigators work to establish how the monitoring provider's infrastructure was compromised.

A Difficult Stretch for Crypto Platform Security

The breach adds to a difficult period for cryptocurrency platform security. On the same day, Binance confirmed a $6.3 billion security breach, with approximately $3 billion in assets frozen following unauthorized transfers across multiple blockchains. There is no evidence linking the two incidents, and their suspected attack methods differ substantially.

For Polymarket, the latest exploit raises renewed questions about third-party dependencies and the protections surrounding browser-based cryptocurrency transactions. Even without direct access to users' private keys or a vulnerability in the underlying smart contracts, malicious code delivered through a trusted website integration was able to trigger unauthorized trades and withdrawals.

Polymarket has restored normal trading and committed to covering user losses, but a complete technical explanation of the DebugBear compromise, the final financial impact and the recovery process remains outstanding.

Source: Crypto Adventure