Polymarket Hacked: Malicious JavaScript from Third-Party Provider Drains $2.7 Million from User Wallets
Polymarket, an international cryptocurrency prediction market, suffered a significant breach via a compromised third-party analytics provider, DebugBear, leading to the theft of approximately $2.7 million from user wallets.
Polymarket, a prominent international cryptocurrency prediction market, experienced a severe security incident on October 29, 2026, when a compromised third-party provider inadvertently exposed its users to substantial wallet theft. Traders on the platform began reporting missing funds, unauthorized withdrawals, and unexpected closure of their positions, prompting Polymarket to temporarily halt trading activities.
The company quickly stated that the issue had been resolved and pledged to reimburse all affected users. Trading was subsequently resumed. In its official statement, Polymarket attributed the breach to a compromised external vendor but did not initially name the provider. Subsequent technical investigations by Hudson Rock have linked the incident to DebugBear, a website performance monitoring service, which allegedly served malicious JavaScript through an address associated with Polymarket.
Instead of its intended function, the injected JavaScript was designed to target active trading sessions. Researchers found that the malicious code scanned for logged-in users, accessed account information, and exploited existing authorization tools to initiate fund transfers. The script reportedly read browser storage for account details, wallet addresses, and API credentials, then searched for active trading clients and their associated signers – the tools used to authorize wallet actions. This method aimed to leverage existing session access rather than relying solely on stolen passwords.
The script's behavior varied depending on the account type, with some attempting direct transfers of position tokens and others trying to sell positions before moving available funds. While researchers did not execute the malicious sample, their analysis indicated an intent to use Polymarket's relayer to request signatures and submit transactions. The exact success rate of these attempted transfers remains unconfirmed.
According to reporting by CNBC, which cited analyses from Betting Intelligence and Polysights, at least $2.7 million was withdrawn from approximately 710 wallets. These figures are considered estimates rather than an officially confirmed total loss. Notably, Polymarket's separate United States platform was reportedly unaffected by this breach.
Polymarket has committed to making affected traders whole. Users who lost less than $10,000 were reportedly informed that their funds would be restored by October 30, 2026, while those with larger claims would need to complete a release form. The incident underscores the significant risks associated with third-party scripts operating on sensitive web pages, a vulnerability that has been seen in other attacks, such as a previous Adform compromise that distributed crypto-stealing code.
To mitigate further risks, users are advised to close potentially exposed browser tabs, meticulously review recent orders and wallet transactions through trusted channels, and save transaction hashes for support claims. Any unexpected signing requests should be rejected. Cybersecurity experts also recommend verifying compensation instructions exclusively through official channels and never sharing seed phrases. Disconnecting a wallet does not automatically reverse completed transfers or revoke existing blockchain approvals.