Cybercriminals have stolen approximately $2.7 million from cryptocurrency traders using the Polymarket prediction market platform after injecting malicious code into a third-party website monitoring script integrated into the platform.
The attack, which occurred on October 29, 2026, affected hundreds of users whose trading positions and cryptocurrency funds were reportedly manipulated and transferred to wallets controlled by the attackers.
Polymarket has confirmed that it is refunding approximately $2.7 million to 726 affected cryptocurrency wallets following the security breach.
Blockchain transaction records indicate that digital assets worth approximately $2.64 million were transferred to the attackers’ wallet within less than an hour.
Investigations revealed that the malicious code was introduced through a compromised script belonging to DebugBear, a third-party service that provides real-user monitoring (RUM) tools for measuring website performance and loading speeds.
Polymarket had integrated the DebugBear script into its website to monitor how quickly its pages loaded for visitors.
However, attackers reportedly hijacked the delivery mechanism used to distribute the script and replaced the legitimate file with a malicious version designed to manipulate users’ cryptocurrency accounts.
Cybersecurity researchers at Hudson Rock obtained the compromised file on October 29 from the address Polymarket used to load the DebugBear script. They also identified changes to Polymarket’s website code that subsequently removed the third-party script.
DebugBear later disclosed that attackers had compromised its DNS records through its domain registrar.
The company said its preliminary investigation suggested that the incident targeted the website of one of its customers. It added that it had not discovered evidence of an intrusion into its own internal systems, although investigations were continuing.
Researchers at Ohey also discovered that a different server began responding to DebugBear’s web addresses at approximately 18:13 UTC, while the malicious script remained accessible.
Earlier that day, the legitimate script had been delivered through Google Cloud Storage. Investigators established that the compromised file was specifically associated with Polymarket rather than every customer using DebugBear’s monitoring service.
How the Attackers Stole Cryptocurrency
An analysis conducted by Hudson Rock revealed that the malicious script was designed to exploit the privileges already available within users’ authenticated Polymarket sessions.
Rather than directly stealing passwords or cryptocurrency wallet recovery phrases, the attackers manipulated the platform’s existing trading functions through the compromised browser script.
The malicious code searched users’ browsers for account information stored by Polymarket, including trading API keys.
However, investigators noted that the API keys alone were insufficient to authorise transactions because cryptocurrency orders also required approval through a wallet signer.
Hudson Rock said it found no evidence that the malicious code transmitted users’ passwords, seed phrases, private keys or API credentials to the attacker’s server.
Instead, the script searched Polymarket’s website for the components responsible for executing trades and obtaining transaction signatures.
It then exploited the platform’s existing transaction-signing mechanisms to carry out unauthorised activities.
The investigation identified two different approaches used against affected accounts.
For users who connected their personal cryptocurrency wallets to Polymarket, the malicious code transferred their trading positions directly to a wallet controlled by the attackers.
For users who accessed the platform through email-based authentication, the attackers reportedly sold their positions at increasingly unfavourable prices before transferring the proceeds out of their accounts.
In both situations, the malicious script attempted to use the account’s existing signing mechanism and Polymarket’s transaction relayer to process the operations.
However, Hudson Rock cautioned that the presence of a signing request does not automatically establish that users approved transactions without being presented with a prompt. Individual wallet providers may apply their own approval requirements and security restrictions.
According to blockchain investigators at Ohey, the attackers’ receiving wallet began accumulating funds at approximately 17:10 UTC, with the last recorded incoming transaction occurring around 18:02 UTC.
During that period, the wallet received approximately 28.6 million POL tokens and trading positions associated with 33 wallets.
At 18:19 UTC, the 28.6 million POL tokens were valued at approximately $2.64 million, based on a market price of $0.0922 per token.
The stolen tokens were subsequently transferred to three different cryptocurrency addresses between 18:28 and 18:38 UTC, according to transaction records.
Polymarket Moves To Refund Affected Users
Polymarket began responding to the incident after detecting unauthorised activity involving users’ wallets.
The platform issued its first public security update at approximately 17:38 UTC on October 29.
By 18:05 UTC, the company had placed its exchange in a cancel-only mode and suspended relayer operations to prevent further unauthorised transactions.
Polymarket said it removed the compromised script within an hour of identifying the incident.
The company also cleared its website caches, reset active user login sessions and temporarily suspended trading while security teams worked to ensure that the platform was safe.
The incident was subsequently referred to law enforcement authorities for further investigation.
By October 30, Polymarket disclosed that 689 of the 726 affected wallets had received full refunds, while payments to the remaining 37 users were being processed following verification.
Beyond the direct losses caused by the malicious script, the company also announced additional compensation of approximately $1.19 million for about 5,500 wallets affected by trading disruptions during the emergency suspension or users whose positions were taken.
The overall compensation package is expected to return approximately $3.9 million to affected traders.
Polymarket said users do not need to submit individual claims to receive their refunds.
However, individuals who believe their compensation is incorrect or who have not received the expected payment can use a dedicated form linked through the company’s status page.
Security Recommendations For Cryptocurrency Platforms
The incident has raised fresh concerns about the risks associated with integrating third-party scripts into websites that handle cryptocurrency transactions and sensitive financial activities.
Following the breach, DebugBear advised customers using its real-user monitoring service to remove its embedded script from their websites as a precaution.
The domain previously used to deliver the compromised file, cdn.debugbear[.]com, reportedly had no DNS record when The Hacker News checked on November 1.
Polymarket also announced plans to restore third-party scripts under stricter security controls, including stronger Content Security Policy (CSP) protections, pinned script versions and sandboxing mechanisms.
Cybersecurity researchers at Hudson Rock advised website operators to avoid loading unnecessary third-party scripts on pages where users conduct financial transactions or approve cryptocurrency operations.
They also recommended implementing Subresource Integrity (SRI), a security mechanism that allows browsers to verify whether externally hosted scripts have been altered before executing them.
Researchers warned that simply trusting a content delivery network or external hosting provider does not guarantee that the files being distributed remain safe.
Website operators were also advised to review the permissions granted to scripts running within authenticated user sessions, particularly those capable of interacting with cryptocurrency wallet-signing functions.
For cryptocurrency traders, the researchers stressed the importance of carefully reviewing wallet-signing requests and rejecting any transaction approval they did not initiate or expect.
The Polymarket incident demonstrates how compromising a single third-party software component can expose thousands of users to financial losses, even when the main platform’s internal infrastructure has not necessarily been breached.
It also highlights the growing cybersecurity risks associated with supply chain attacks, where hackers exploit trusted external services to gain access to otherwise legitimate websites and their users.