$2 Million+ Drained From Polymarket Traders in New Supply Chain Attack

Hi, what are you looking for?

Malicious code linked to a website monitoring tool was designed to hijack logged-in Polymarket sessions and siphon user funds.

By

Flipboard

Reddit

Whatsapp

Whatsapp

Email

Polymarket halted trading on its international platform on October 29 after users reported unauthorized withdrawals.According to the prediction market’sstatus page, the exchange was first switched to cancel-only mode, with relayer actions suspended.“We’ve identified & fixed an issue impacting our international platform, Polymarket.com. One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement. Anyone who has been impacted will be made whole,” the companysaid.Trading resumed about an hour later, and Polymarket pledged to reimburse all affected traders. It has not named the vendor or disclosed losses.Researchers have linked the theft to malicious code served from DebugBear, a UK-based website performance monitoring firm. Polymarket’s US platform was reportedly unaffected.DebugBear confirmedbeing “impacted by an ongoing security incident” and urged users of its real user monitoring (RUM) product to pull its snippet from their websites. It also said it brought in specialist incident responders.Advertisement. Scroll to continue reading.Hudson Rock obtained a copy of the malicious JavaScript from a DebugBear address used by Polymarket. The code hunted for a logged-in user’s trading tools and portfolio. Depending on the account type, it then tried either to sell positions and move the proceeds, or to send position tokens straight to an attacker-set address.“The sample reads credential-related material, but our review did not identify a routine that sends the credential map, a password, a seed phrase, or a private key to its reporting endpoint. Its central approach is to reuse authority already available in the authenticated application,”Hudson Rock said.The firm also spotted a Polymarket production build, timestamped 17:59 UTC, with a change note about removing the DebugBear script.Loss figures vary. A screenshot reviewed by Hudson Rock showed about $2.19 million at the script’s hard-coded fallback address, though the firm said this is not a verified tally.Blockchain security firm GoPlus, which alsoattributedthe attack to a supply chain compromise of DebugBear’s RUM script, puts losses at roughly $2.71 million. According to its on-chain analysis, the main attack path ran through 710 deposit wallets and 731 addresses, though the address count does not equal the number of victims.Arkham datashowed a suspected attacker wallet holding approximately $2.65 million. That is the same address hardcoded in the script as its fallback recipient.Hudson Rock has not determined how the script was tampered with or how many users were hit. Its findings do not indicate that other DebugBear customers were targeted.The attack came the same dayBinance was hit by a roughly $6 billion hackthat blockchain intelligence firms have attributed to North Korea. In June,Polymarket disclosedanother third-party compromise that injected a malicious script into its frontend, with losses reported at around $3 million.Related:Personal Information for Over 1 Million People Stolen in a Cyberattack on Arizona’s Court SystemRelated:BigCommerce Data Stolen via Ribon Apps HackRelated:Hackers Return $263 Million Stolen From Liquid Network

According to the prediction market’sstatus page, the exchange was first switched to cancel-only mode, with relayer actions suspended.“We’ve identified & fixed an issue impacting our international platform, Polymarket.com. One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement. Anyone who has been impacted will be made whole,” the companysaid.Trading resumed about an hour later, and Polymarket pledged to reimburse all affected traders. It has not named the vendor or disclosed losses.Researchers have linked the theft to malicious code served from DebugBear, a UK-based website performance monitoring firm. Polymarket’s US platform was reportedly unaffected.DebugBear confirmedbeing “impacted by an ongoing security incident” and urged users of its real user monitoring (RUM) product to pull its snippet from their websites. It also said it brought in specialist incident responders.Advertisement. Scroll to continue reading.Hudson Rock obtained a copy of the malicious JavaScript from a DebugBear address used by Polymarket. The code hunted for a logged-in user’s trading tools and portfolio. Depending on the account type, it then tried either to sell positions and move the proceeds, or to send position tokens straight to an attacker-set address.“The sample reads credential-related material, but our review did not identify a routine that sends the credential map, a password, a seed phrase, or a private key to its reporting endpoint. Its central approach is to reuse authority already available in the authenticated application,”Hudson Rock said.The firm also spotted a Polymarket production build, timestamped 17:59 UTC, with a change note about removing the DebugBear script.Loss figures vary. A screenshot reviewed by Hudson Rock showed about $2.19 million at the script’s hard-coded fallback address, though the firm said this is not a verified tally.Blockchain security firm GoPlus, which alsoattributedthe attack to a supply chain compromise of DebugBear’s RUM script, puts losses at roughly $2.71 million. According to its on-chain analysis, the main attack path ran through 710 deposit wallets and 731 addresses, though the address count does not equal the number of victims.Arkham datashowed a suspected attacker wallet holding approximately $2.65 million. That is the same address hardcoded in the script as its fallback recipient.Hudson Rock has not determined how the script was tampered with or how many users were hit. Its findings do not indicate that other DebugBear customers were targeted.The attack came the same dayBinance was hit by a roughly $6 billion hackthat blockchain intelligence firms have attributed to North Korea. In June,Polymarket disclosedanother third-party compromise that injected a malicious script into its frontend, with losses reported at around $3 million.Related:Personal Information for Over 1 Million People Stolen in a Cyberattack on Arizona’s Court SystemRelated:BigCommerce Data Stolen via Ribon Apps HackRelated:Hackers Return $263 Million Stolen From Liquid Network

“We’ve identified & fixed an issue impacting our international platform, Polymarket.com. One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement. Anyone who has been impacted will be made whole,” the companysaid.Trading resumed about an hour later, and Polymarket pledged to reimburse all affected traders. It has not named the vendor or disclosed losses.Researchers have linked the theft to malicious code served from DebugBear, a UK-based website performance monitoring firm. Polymarket’s US platform was reportedly unaffected.DebugBear confirmedbeing “impacted by an ongoing security incident” and urged users of its real user monitoring (RUM) product to pull its snippet from their websites. It also said it brought in specialist incident responders.Advertisement. Scroll to continue reading.Hudson Rock obtained a copy of the malicious JavaScript from a DebugBear address used by Polymarket. The code hunted for a logged-in user’s trading tools and portfolio. Depending on the account type, it then tried either to sell positions and move the proceeds, or to send position tokens straight to an attacker-set address.“The sample reads credential-related material, but our review did not identify a routine that sends the credential map, a password, a seed phrase, or a private key to its reporting endpoint. Its central approach is to reuse authority already available in the authenticated application,”Hudson Rock said.The firm also spotted a Polymarket production build, timestamped 17:59 UTC, with a change note about removing the DebugBear script.Loss figures vary. A screenshot reviewed by Hudson Rock showed about $2.19 million at the script’s hard-coded fallback address, though the firm said this is not a verified tally.Blockchain security firm GoPlus, which alsoattributedthe attack to a supply chain compromise of DebugBear’s RUM script, puts losses at roughly $2.71 million. According to its on-chain analysis, the main attack path ran through 710 deposit wallets and 731 addresses, though the address count does not equal the number of victims.Arkham datashowed a suspected attacker wallet holding approximately $2.65 million. That is the same address hardcoded in the script as its fallback recipient.Hudson Rock has not determined how the script was tampered with or how many users were hit. Its findings do not indicate that other DebugBear customers were targeted.The attack came the same dayBinance was hit by a roughly $6 billion hackthat blockchain intelligence firms have attributed to North Korea. In June,Polymarket disclosedanother third-party compromise that injected a malicious script into its frontend, with losses reported at around $3 million.Related:Personal Information for Over 1 Million People Stolen in a Cyberattack on Arizona’s Court SystemRelated:BigCommerce Data Stolen via Ribon Apps HackRelated:Hackers Return $263 Million Stolen From Liquid Network

Trading resumed about an hour later, and Polymarket pledged to reimburse all affected traders. It has not named the vendor or disclosed losses.Researchers have linked the theft to malicious code served from DebugBear, a UK-based website performance monitoring firm. Polymarket’s US platform was reportedly unaffected.DebugBear confirmedbeing “impacted by an ongoing security incident” and urged users of its real user monitoring (RUM) product to pull its snippet from their websites. It also said it brought in specialist incident responders.Advertisement. Scroll to continue reading.Hudson Rock obtained a copy of the malicious JavaScript from a DebugBear address used by Polymarket. The code hunted for a logged-in user’s trading tools and portfolio. Depending on the account type, it then tried either to sell positions and move the proceeds, or to send position tokens straight to an attacker-set address.“The sample reads credential-related material, but our review did not identify a routine that sends the credential map, a password, a seed phrase, or a private key to its reporting endpoint. Its central approach is to reuse authority already available in the authenticated application,”Hudson Rock said.The firm also spotted a Polymarket production build, timestamped 17:59 UTC, with a change note about removing the DebugBear script.Loss figures vary. A screenshot reviewed by Hudson Rock showed about $2.19 million at the script’s hard-coded fallback address, though the firm said this is not a verified tally.Blockchain security firm GoPlus, which alsoattributedthe attack to a supply chain compromise of DebugBear’s RUM script, puts losses at roughly $2.71 million. According to its on-chain analysis, the main attack path ran through 710 deposit wallets and 731 addresses, though the address count does not equal the number of victims.Arkham datashowed a suspected attacker wallet holding approximately $2.65 million. That is the same address hardcoded in the script as its fallback recipient.Hudson Rock has not determined how the script was tampered with or how many users were hit. Its findings do not indicate that other DebugBear customers were targeted.The attack came the same dayBinance was hit by a roughly $6 billion hackthat blockchain intelligence firms have attributed to North Korea. In June,Polymarket disclosedanother third-party compromise that injected a malicious script into its frontend, with losses reported at around $3 million.Related:Personal Information for Over 1 Million People Stolen in a Cyberattack on Arizona’s Court SystemRelated:BigCommerce Data Stolen via Ribon Apps HackRelated:Hackers Return $263 Million Stolen From Liquid Network

Researchers have linked the theft to malicious code served from DebugBear, a UK-based website performance monitoring firm. Polymarket’s US platform was reportedly unaffected.DebugBear confirmedbeing “impacted by an ongoing security incident” and urged users of its real user monitoring (RUM) product to pull its snippet from their websites. It also said it brought in specialist incident responders.Advertisement. Scroll to continue reading.Hudson Rock obtained a copy of the malicious JavaScript from a DebugBear address used by Polymarket. The code hunted for a logged-in user’s trading tools and portfolio. Depending on the account type, it then tried either to sell positions and move the proceeds, or to send position tokens straight to an attacker-set address.“The sample reads credential-related material, but our review did not identify a routine that sends the credential map, a password, a seed phrase, or a private key to its reporting endpoint. Its central approach is to reuse authority already available in the authenticated application,”Hudson Rock said.The firm also spotted a Polymarket production build, timestamped 17:59 UTC, with a change note about removing the DebugBear script.Loss figures vary. A screenshot reviewed by Hudson Rock showed about $2.19 million at the script’s hard-coded fallback address, though the firm said this is not a verified tally.Blockchain security firm GoPlus, which alsoattributedthe attack to a supply chain compromise of DebugBear’s RUM script, puts losses at roughly $2.71 million. According to its on-chain analysis, the main attack path ran through 710 deposit wallets and 731 addresses, though the address count does not equal the number of victims.Arkham datashowed a suspected attacker wallet holding approximately $2.65 million. That is the same address hardcoded in the script as its fallback recipient.Hudson Rock has not determined how the script was tampered with or how many users were hit. Its findings do not indicate that other DebugBear customers were targeted.The attack came the same dayBinance was hit by a roughly $6 billion hackthat blockchain intelligence firms have attributed to North Korea. In June,Polymarket disclosedanother third-party compromise that injected a malicious script into its frontend, with losses reported at around $3 million.Related:Personal Information for Over 1 Million People Stolen in a Cyberattack on Arizona’s Court SystemRelated:BigCommerce Data Stolen via Ribon Apps HackRelated:Hackers Return $263 Million Stolen From Liquid Network

DebugBear confirmedbeing “impacted by an ongoing security incident” and urged users of its real user monitoring (RUM) product to pull its snippet from their websites. It also said it brought in specialist incident responders.Advertisement. Scroll to continue reading.Hudson Rock obtained a copy of the malicious JavaScript from a DebugBear address used by Polymarket. The code hunted for a logged-in user’s trading tools and portfolio. Depending on the account type, it then tried either to sell positions and move the proceeds, or to send position tokens straight to an attacker-set address.“The sample reads credential-related material, but our review did not identify a routine that sends the credential map, a password, a seed phrase, or a private key to its reporting endpoint. Its central approach is to reuse authority already available in the authenticated application,”Hudson Rock said.The firm also spotted a Polymarket production build, timestamped 17:59 UTC, with a change note about removing the DebugBear script.Loss figures vary. A screenshot reviewed by Hudson Rock showed about $2.19 million at the script’s hard-coded fallback address, though the firm said this is not a verified tally.Blockchain security firm GoPlus, which alsoattributedthe attack to a supply chain compromise of DebugBear’s RUM script, puts losses at roughly $2.71 million. According to its on-chain analysis, the main attack path ran through 710 deposit wallets and 731 addresses, though the address count does not equal the number of victims.Arkham datashowed a suspected attacker wallet holding approximately $2.65 million. That is the same address hardcoded in the script as its fallback recipient.Hudson Rock has not determined how the script was tampered with or how many users were hit. Its findings do not indicate that other DebugBear customers were targeted.The attack came the same dayBinance was hit by a roughly $6 billion hackthat blockchain intelligence firms have attributed to North Korea. In June,Polymarket disclosedanother third-party compromise that injected a malicious script into its frontend, with losses reported at around $3 million.Related:Personal Information for Over 1 Million People Stolen in a Cyberattack on Arizona’s Court SystemRelated:BigCommerce Data Stolen via Ribon Apps HackRelated:Hackers Return $263 Million Stolen From Liquid Network

Hudson Rock obtained a copy of the malicious JavaScript from a DebugBear address used by Polymarket. The code hunted for a logged-in user’s trading tools and portfolio. Depending on the account type, it then tried either to sell positions and move the proceeds, or to send position tokens straight to an attacker-set address.“The sample reads credential-related material, but our review did not identify a routine that sends the credential map, a password, a seed phrase, or a private key to its reporting endpoint. Its central approach is to reuse authority already available in the authenticated application,”Hudson Rock said.The firm also spotted a Polymarket production build, timestamped 17:59 UTC, with a change note about removing the DebugBear script.Loss figures vary. A screenshot reviewed by Hudson Rock showed about $2.19 million at the script’s hard-coded fallback address, though the firm said this is not a verified tally.Blockchain security firm GoPlus, which alsoattributedthe attack to a supply chain compromise of DebugBear’s RUM script, puts losses at roughly $2.71 million. According to its on-chain analysis, the main attack path ran through 710 deposit wallets and 731 addresses, though the address count does not equal the number of victims.Arkham datashowed a suspected attacker wallet holding approximately $2.65 million. That is the same address hardcoded in the script as its fallback recipient.Hudson Rock has not determined how the script was tampered with or how many users were hit. Its findings do not indicate that other DebugBear customers were targeted.The attack came the same dayBinance was hit by a roughly $6 billion hackthat blockchain intelligence firms have attributed to North Korea. In June,Polymarket disclosedanother third-party compromise that injected a malicious script into its frontend, with losses reported at around $3 million.Related:Personal Information for Over 1 Million People Stolen in a Cyberattack on Arizona’s Court SystemRelated:BigCommerce Data Stolen via Ribon Apps HackRelated:Hackers Return $263 Million Stolen From Liquid Network

“The sample reads credential-related material, but our review did not identify a routine that sends the credential map, a password, a seed phrase, or a private key to its reporting endpoint. Its central approach is to reuse authority already available in the authenticated application,”Hudson Rock said.The firm also spotted a Polymarket production build, timestamped 17:59 UTC, with a change note about removing the DebugBear script.Loss figures vary. A screenshot reviewed by Hudson Rock showed about $2.19 million at the script’s hard-coded fallback address, though the firm said this is not a verified tally.Blockchain security firm GoPlus, which alsoattributedthe attack to a supply chain compromise of DebugBear’s RUM script, puts losses at roughly $2.71 million. According to its on-chain analysis, the main attack path ran through 710 deposit wallets and 731 addresses, though the address count does not equal the number of victims.Arkham datashowed a suspected attacker wallet holding approximately $2.65 million. That is the same address hardcoded in the script as its fallback recipient.Hudson Rock has not determined how the script was tampered with or how many users were hit. Its findings do not indicate that other DebugBear customers were targeted.The attack came the same dayBinance was hit by a roughly $6 billion hackthat blockchain intelligence firms have attributed to North Korea. In June,Polymarket disclosedanother third-party compromise that injected a malicious script into its frontend, with losses reported at around $3 million.Related:Personal Information for Over 1 Million People Stolen in a Cyberattack on Arizona’s Court SystemRelated:BigCommerce Data Stolen via Ribon Apps HackRelated:Hackers Return $263 Million Stolen From Liquid Network

The firm also spotted a Polymarket production build, timestamped 17:59 UTC, with a change note about removing the DebugBear script.Loss figures vary. A screenshot reviewed by Hudson Rock showed about $2.19 million at the script’s hard-coded fallback address, though the firm said this is not a verified tally.Blockchain security firm GoPlus, which alsoattributedthe attack to a supply chain compromise of DebugBear’s RUM script, puts losses at roughly $2.71 million. According to its on-chain analysis, the main attack path ran through 710 deposit wallets and 731 addresses, though the address count does not equal the number of victims.Arkham datashowed a suspected attacker wallet holding approximately $2.65 million. That is the same address hardcoded in the script as its fallback recipient.Hudson Rock has not determined how the script was tampered with or how many users were hit. Its findings do not indicate that other DebugBear customers were targeted.The attack came the same dayBinance was hit by a roughly $6 billion hackthat blockchain intelligence firms have attributed to North Korea. In June,Polymarket disclosedanother third-party compromise that injected a malicious script into its frontend, with losses reported at around $3 million.Related:Personal Information for Over 1 Million People Stolen in a Cyberattack on Arizona’s Court SystemRelated:BigCommerce Data Stolen via Ribon Apps HackRelated:Hackers Return $263 Million Stolen From Liquid Network

Loss figures vary. A screenshot reviewed by Hudson Rock showed about $2.19 million at the script’s hard-coded fallback address, though the firm said this is not a verified tally.Blockchain security firm GoPlus, which alsoattributedthe attack to a supply chain compromise of DebugBear’s RUM script, puts losses at roughly $2.71 million. According to its on-chain analysis, the main attack path ran through 710 deposit wallets and 731 addresses, though the address count does not equal the number of victims.Arkham datashowed a suspected attacker wallet holding approximately $2.65 million. That is the same address hardcoded in the script as its fallback recipient.Hudson Rock has not determined how the script was tampered with or how many users were hit. Its findings do not indicate that other DebugBear customers were targeted.The attack came the same dayBinance was hit by a roughly $6 billion hackthat blockchain intelligence firms have attributed to North Korea. In June,Polymarket disclosedanother third-party compromise that injected a malicious script into its frontend, with losses reported at around $3 million.Related:Personal Information for Over 1 Million People Stolen in a Cyberattack on Arizona’s Court SystemRelated:BigCommerce Data Stolen via Ribon Apps HackRelated:Hackers Return $263 Million Stolen From Liquid Network

Blockchain security firm GoPlus, which alsoattributedthe attack to a supply chain compromise of DebugBear’s RUM script, puts losses at roughly $2.71 million. According to its on-chain analysis, the main attack path ran through 710 deposit wallets and 731 addresses, though the address count does not equal the number of victims.Arkham datashowed a suspected attacker wallet holding approximately $2.65 million. That is the same address hardcoded in the script as its fallback recipient.Hudson Rock has not determined how the script was tampered with or how many users were hit. Its findings do not indicate that other DebugBear customers were targeted.The attack came the same dayBinance was hit by a roughly $6 billion hackthat blockchain intelligence firms have attributed to North Korea. In June,Polymarket disclosedanother third-party compromise that injected a malicious script into its frontend, with losses reported at around $3 million.Related:Personal Information for Over 1 Million People Stolen in a Cyberattack on Arizona’s Court SystemRelated:BigCommerce Data Stolen via Ribon Apps HackRelated:Hackers Return $263 Million Stolen From Liquid Network

Arkham datashowed a suspected attacker wallet holding approximately $2.65 million. That is the same address hardcoded in the script as its fallback recipient.Hudson Rock has not determined how the script was tampered with or how many users were hit. Its findings do not indicate that other DebugBear customers were targeted.The attack came the same dayBinance was hit by a roughly $6 billion hackthat blockchain intelligence firms have attributed to North Korea. In June,Polymarket disclosedanother third-party compromise that injected a malicious script into its frontend, with losses reported at around $3 million.Related:Personal Information for Over 1 Million People Stolen in a Cyberattack on Arizona’s Court SystemRelated:BigCommerce Data Stolen via Ribon Apps HackRelated:Hackers Return $263 Million Stolen From Liquid Network

Hudson Rock has not determined how the script was tampered with or how many users were hit. Its findings do not indicate that other DebugBear customers were targeted.The attack came the same dayBinance was hit by a roughly $6 billion hackthat blockchain intelligence firms have attributed to North Korea. In June,Polymarket disclosedanother third-party compromise that injected a malicious script into its frontend, with losses reported at around $3 million.Related:Personal Information for Over 1 Million People Stolen in a Cyberattack on Arizona’s Court SystemRelated:BigCommerce Data Stolen via Ribon Apps HackRelated:Hackers Return $263 Million Stolen From Liquid Network

The attack came the same dayBinance was hit by a roughly $6 billion hackthat blockchain intelligence firms have attributed to North Korea. In June,Polymarket disclosedanother third-party compromise that injected a malicious script into its frontend, with losses reported at around $3 million.Related:Personal Information for Over 1 Million People Stolen in a Cyberattack on Arizona’s Court SystemRelated:BigCommerce Data Stolen via Ribon Apps HackRelated:Hackers Return $263 Million Stolen From Liquid Network

Related:Personal Information for Over 1 Million People Stolen in a Cyberattack on Arizona’s Court SystemRelated:BigCommerce Data Stolen via Ribon Apps HackRelated:Hackers Return $263 Million Stolen From Liquid Network

Related:BigCommerce Data Stolen via Ribon Apps HackRelated:Hackers Return $263 Million Stolen From Liquid Network

Related:Hackers Return $263 Million Stolen From Liquid Network

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Barracuda has appointed Dan Fletcher as CFO.

Artemis Security has appointed Arun Singh as CGO.

General Paul M. Nakasone has joined Armadin’s Board of Directors.

As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.(Torsten George)

Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)

The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)

Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)

Flipboard

Reddit

Whatsapp

Whatsapp

Email

Got a confidential news tip? We want to hear from you.

Reach a large audience of enterprise cybersecurity professionals

Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.

Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.