Polymarket Hack Drains Estimated $2.7M From Hundreds of Traders

Hackers siphoned an estimated $2.7 million from hundreds of Polymarket accounts Thursday (Oct. 29) after compromising software supplied by a third-party provider, prompting the prediction market operator to suspend trading temporarily and promise reimbursements.

Blockchain analytics firm Bubblemaps estimated that around 700 users were affected by the attack on Polymarket’s international platform. The company has not confirmed the number of victims or the amount stolen, but said it had fixed the issue and would make affected customers whole.

The incident affected Polymarket.com, its cryptocurrency-based international exchange, not Polymarket US, which operates separately under US financial regulation.

Security researchers found that attackers had tampered with JavaScript code embedded in Polymarket’s website, allowing malicious instructions to run when traders visited the legitimate site. The breach involved DebugBear, a UK-based provider of website performance-monitoring software.

How Hackers Targeted Traders

Cybersecurity researchers at Hudson Rock identified a modified script hosted on DebugBear’s infrastructure that attempted to exploit traders’ existing logged-in sessions.

According to an analysis by BleepingComputer, the code checked users’ cryptocurrency balances and open prediction-market positions before attempting to sell holdings or transfer assets to a wallet controlled by the attackers.

That meant users could potentially lose money without following a phishing link or disclosing their passwords.

BleepingComputer traced transactions involving approximately $2.57 million in Polygon’s POL cryptocurrency from a suspected attacker wallet to three other addresses.

DebugBear acknowledged an ongoing security incident and urged customers using its Real User Monitoring product to remove the software’s embedded code from their websites. The company has not publicly established how its systems were compromised.

Trading Halted

Polymarket placed its exchange into cancel-only mode at 2:05 p.m. Eastern on Thursday, preventing new trades while allowing existing orders to be canceled. It resumed normal trading around 3:05 p.m., according to the company’s status page.

“One of our third party providers was compromised,” Polymarket said, adding that it had referred the incident to UK law enforcement.

The company subsequently said trading was fully restored and pledged to reimburse affected traders.

According to CNBC, Polymarket told users on Discord that those who lost less than $10,000 would have their funds restored by Friday (Oct. 30). Those who lost larger amounts would be required to sign a release agreement before receiving reimbursement.

It’s not the first security incident to hit Polymarket. In June, another third-party breach resulted in approximately $3 million being stolen from users, according to CoinDesk.