Polymarket halted trading on its international platform on October 29 after users reported unauthorized withdrawals.
According to the prediction market’s status page, the exchange was first switched to cancel-only mode, with relayer actions suspended.
“We’ve identified & fixed an issue impacting our international platform, Polymarket.com. One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement. Anyone who has been impacted will be made whole,” the company said.
Trading resumed about an hour later, and Polymarket pledged to reimburse all affected traders. It has not named the vendor or disclosed losses.
Researchers have linked the theft to malicious code served from DebugBear, a UK-based website performance monitoring firm. Polymarket’s US platform was reportedly unaffected.
DebugBear confirmed being “impacted by an ongoing security incident” and urged users of its real user monitoring (RUM) product to pull its snippet from their websites. It also said it brought in specialist incident responders.
Hudson Rock obtained a copy of the malicious JavaScript from a DebugBear address used by Polymarket. The code hunted for a logged-in user’s trading tools and portfolio. Depending on the account type, it then tried either to sell positions and move the proceeds, or to send position tokens straight to an attacker-set address.
“The sample reads credential-related material, but our review did not identify a routine that sends the credential map, a password, a seed phrase, or a private key to its reporting endpoint. Its central approach is to reuse authority already available in the authenticated application,” Hudson Rock said.
The firm also spotted a Polymarket production build, timestamped 17:59 UTC, with a change note about removing the DebugBear script.
Loss figures vary. A screenshot reviewed by Hudson Rock showed about $2.19 million at the script’s hard-coded fallback address, though the firm said this is not a verified tally.
Blockchain security firm GoPlus, which also attributed the attack to a supply chain compromise of DebugBear’s RUM script, puts losses at roughly $2.71 million. According to its on-chain analysis, the main attack path ran through 710 deposit wallets and 731 addresses, though the address count does not equal the number of victims.
Arkham data showed a suspected attacker wallet holding approximately $2.65 million. That is the same address hardcoded in the script as its fallback recipient.
Hudson Rock has not determined how the script was tampered with or how many users were hit. Its findings do not indicate that other DebugBear customers were targeted.
The attack came the same day Binance was hit by a roughly $6 billion hack that blockchain intelligence firms have attributed to North Korea. In June, Polymarket disclosed another third-party compromise that injected a malicious script into its frontend, with losses reported at around $3 million.
Related: Personal Information for Over 1 Million People Stolen in a Cyberattack on Arizona’s Court System
Related: BigCommerce Data Stolen via Ribon Apps Hack
Related: Hackers Return $263 Million Stolen From Liquid Network
