Polymarket Users Lose $2.7 Million in Third-Party Script Hack

Listen to this article

Press play to start listening

Prediction market platformPolymarketbriefly halted trading on its international exchange on Thursday, October 29, after users reported unauthorized withdrawals from their wallets. Blockchain analytics firms Betting Intelligence and Polysights estimated that attackers took about $2.7 million from 710 wallets.

The incident involved a compromised third-party performance-monitoring script supplied by DebugBear, a UK-based website performance vendor whose code ran onPolymarket.com.

In itspost-incident update, Polymarket said the attacker replaced DebugBear’s monitoring script with malicious code designed to target its users. For users who had Polymarket open during a short window, the script used their active sessions to sell trading positions and move funds out of their wallets.

The incident didn’t involve a reported breach of Polymarket’ssmart contracts; instead, attackers reportedly abused a trusted third-party script running on the website. Polymarket removed the compromised code, cleared its caches, paused trading and relayer actions, and reset active login sessions.

The platform moved into cancel-only mode at around 2:00 p.m. ET and resumed trading at 3:00 p.m. ET. Its separate US platform was not affected. DebugBearacknowledgedan “ongoing security incident” and asked customers using its real-user monitoring (RUM) product to remove the embedded code.

Polymarket referred the incident to UK law enforcement and pledged to reimburse affected traders. By Friday afternoon, it said95% of affected wallets had been refunded.The company said it was returning $3.9 million in total: $2.7 million for stolen funds and another $1.2 million to cover losses linked to the trading pause.

“In total, we’re returning $3.9M to traders: the $2.7M plus $1.2M to cover pause-related losses. No claims or tickets needed: we identified eligible wallets from on-chain and trading data,” the company stated in its update.

Users whose losses were below $10,000 were due to receive refunds by October 30, while those with larger losses were asked to complete a release form.

The incident came days before the November 3 US midterm elections, when prediction markets expected higher trading volumes. It was also Polymarket’s second reported third-party website compromise this year.

In April, the platformrejected a hacker’s claimof stealing more than 300,000 user records, arguing that the information was already publicly accessible through its APIs and blockchain data. Then in June, attackers used malicious code injected through a vendor tosteal about $3 millionfrom users.

Security professionals note that managing third-party web scripts remains a tough problem for online platforms. In comments shared with Hackread.com, Gareth Bowker, Head of Information Security at Jscrambler, explained why standard web protections often fail in these scenarios:

“The malicious script exchanged data with a server on DebugBear’s own domain. A content security policy that permits a trusted vendor’s domain would have allowed that traffic. Subresource integrity checks are also of limited use for real-user monitoring scripts, because vendors update those scripts frequently. Static controls are necessary, but they are not sufficient on their own. Organizations also need to monitor what third-party code does in the browser at runtime.”

Bowker also discussed what steps traders should take following the incident, stating, “Polymarket’s prompt decision to halt trading, and its commitment to reimburse affected traders in full, should limit the losses for users. Users should still review their transaction history and revoke any token approvals they do not recognize. A user cannot reasonably detect a malicious script on a trusted site. Control over what runs on that site is the platform’s responsibility.”

Your email address will not be published.Required fields are marked*

Comment*

Name*

Email*

Website

Δ

Email Address*

FIRSTNAME

LASTNAME