Polymarket traders lost an estimated $2.7 million on October 29 after a compromised third-party monitoring script turned the prediction market’s own website into a wallet drainer. The code did not need a single password or seed phrase. It waited for users to log in, then used the trading permissions already loaded in their browser sessions to dump positions and move the proceeds out.
Polymarket confirmed that “one of our third party providers was compromised” and said it had referred the matter to law enforcement. The company has not publicly named the provider, but UK website performance monitoring firm DebugBear disclosed the same afternoon that it was dealing with an ongoing security incident and urged customers of its real user monitoring (RUM) product to pull its embed code from their websites.
A trusted script with a hidden routine
RUM tools load a small piece of JavaScript on every page view to measure real visitor performance. Code served from a vendor’s CDN runs with the same privileges as the site that embeds it, including inside logged-in trading sessions.
Security researchers at Hudson Rock, who published an analysis of the payload, found a roughly 15,000-byte unobfuscated function named startdebugger delivered through DebugBear’s script. According to their review, the code:
- Read authentication entries from the browser’s local storage
- Searched the React application’s internals to locate Polymarket’s trading client and signer
- Inventoried each victim’s open positions and balances, skipping accounts below roughly $10 and checking geoblock status
- Reported its progress to an attacker-controlled endpoint hosted on DebugBear infrastructure
For accounts created through Polymarket’s email login, the script reportedly fired a cascade of fill-and-kill sell orders, first at about 97% of market price, then 50%, then the minimum tick, before withdrawing the funds. For accounts tied to a traditional externally owned wallet, it transferred outcome tokens directly.
Hudson Rock said its “review did not identify a routine that sends the credential map, a password, a seed phrase, or a private key to its reporting endpoint. Its central approach is to reuse authority already available in the authenticated application.” Victims did not need to click anything or approve a transaction.
Under an hour from discovery to fix
Polymarket’s status page shows the platform switched to cancel-only mode and paused relayer actions at 2:05 PM ET. A production build timestamped 1:59 PM ET reportedly included a commit stripping the DebugBear RUM script from the site.
At 2:37 PM ET, Polymarket posted that it had “identified and fixed the issue impacting our international platform, Polymarket.com,” adding that “anyone who has been impacted will be made whole.” The incident was marked resolved at 3:05 PM ET, and trading resumed about an hour after the halt. The company’s US platform was not affected.
Counting the losses
Polymarket has not disclosed a total, and blockchain analytics firms have landed on slightly different figures:
- GoPlus Security: about $2.71 million drained across 710 deposit wallets and 731 addresses
- Arkham Intelligence: about $2.65 million sitting in the suspected attacker wallet
- Hudson Rock: about $2.19 million observed at the script’s hard-coded fallback wallet, which it noted was not a verified tally
Polymarket said on X that it is “fully reimbursing all affected traders.” According to reports, users who lost less than $10,000 had funds restored by October 30, while those with larger losses must sign a release form before repayment. The company reportedly referred the case to UK law enforcement because DebugBear is based in the United Kingdom.
What DebugBear has said
DebugBear stated on X that it was “impacted by an ongoing security incident” and asked RUM customers to remove its embed code. The company said it brought in incident responders. DebugBear had not issued any public statement explaining how its script was modified at time of publication, and there is no public indication that the malicious code targeted any customer besides Polymarket.
Polymarket’s second frontend hit this year
This is not the first time Polymarket’s web frontend has been turned against its users. A separate compromise of a third-party frontend script in June reportedly cost traders around $3 million, and BreachNews previously covered claims that Polymarket APIs exposed 300,000 records through misconfigured endpoints.
The technique mirrors classic Magecart skimming, where attackers poison a script that hundreds of sites trust, as seen when a group hijacked the Convertr analytics script to steal card data. The difference here is the payoff. Instead of harvesting card numbers for later resale, the script cashed out live crypto positions in real time.
The timing also stood out. The Polymarket drain hit the same day as the $6.3 billion Binance hot wallet theft, although there is no evidence the 2 incidents are connected.
Lessons for sites running third-party code
Any platform that lets users trade or move money in the browser is only as secure as the least protected script on the page. Practical defenses include:
- Keeping analytics and monitoring scripts off authenticated pages that can sign transactions
- Self-hosting vendor code with Subresource Integrity hashes instead of loading it live from a CDN
- Enforcing a strict Content Security Policy that limits where scripts can send data
Polymarket users who suspect they were affected should check their trade history for sell orders placed on October 29 that they did not initiate and follow the reimbursement instructions shared through the company’s official channels.
