Polymarket traders drained of about $2.5 million through a compromised third-party script
October 29, 2026 (October 29, 2026)
On October 29 a script loaded from a third-party performance-monitoring service ran inside traders' logged-in Polymarket sessions and sent transactions to an attacker's wallet. Researchers traced the file to DebugBear's content network, where a normal real-user-monitoring script had been replaced. Polymarket has not named the provider. According to analysis of the code, it read the browser's stored login data and API credentials, found the page's trading signer and submitted signed transfers through Polymarket's relayer, so no seed phrase or private key was needed. Blockchain trackers traced about $2.5 million to one attacker wallet across more than 900 transactions, and other estimates run from about $2.65 million to $2.7 million. Hudson Rock's analysis found about $2.19 million at the wallet and says that is not a verified total, and nobody has confirmed how many users lost money. SafeState reports that Polymarket confirmed within the hour that a compromised third-party provider was responsible, paused trading, resumed it about half an hour after marking the incident resolved, and said it would reimburse affected traders. Hudson Rock found no company statement when it published. The attack affected only the international site, not Polymarket's US exchange.
Why it matters
The attackers did not break into Polymarket's servers or steal keys. They put malicious code into a page that traders trust, and a script meant to measure page speed could see and use everything on the page.
What defenders can take from it
- Sites that handle wallets: remove unnecessary third-party scripts from pages that can sign or move funds, use Subresource Integrity and a strict Content Security Policy, and audit what page code can ask the signer to do.
- Users: reject unexpected signing or approval requests, review orders and positions from a clean session, and ignore unsolicited recovery offers. Never share a seed phrase.