- Malicious code on Polymarket‘s site, loaded via a compromised DebugBear script, drained funds from signed-in traders on October 29.
- Hackers stole roughly $2.64 million in POL tokens and positions; Polymarket is refunding about $2.7 million to 726 wallets and paying an additional $1.19 million for related losses.
- The attack used existing trading API keys and wallet signers to move positions or sell them at worsening prices, without stealing passwords or seed phrases.
- DebugBear‘s DNS was compromised through its domain registrar, and the malicious file targeted only Polymarket‘s copy of the script.
- Polymarket removed the script, reset sessions, and paused trading; it is also implementing stricter security checks for third-party code.
On October 29, malicious code on Polymarket‘s website drained funds from signed-in traders by exploiting a compromised third-party script from DebugBear. The code replaced a page-speed script that the site loaded from an outside company, Polymarket said on X.
Blockchain records show crypto worth about $2.64 million reached the hackers’ wallet in under an hour. Researchers at Hudson Rock downloaded the malicious file and found it reused access from signed-in sessions.
The code read account details stored in the browser, including trading API keys, but did not send passwords or private keys to the attackers. Instead, it searched the page for the order-placing interface and the wallet signer, then used the trader’s own signer to approve transactions.
For accounts signing in with a crypto wallet, it moved positions directly to the hackers. For email-login accounts, it sold positions at ever-lower prices before moving the money out. The wallet written into the code received its first funds at 17:10 UTC and its last at 18:02 UTC, according to Ohey’s blockchain trace. It collected 28.6 million POL tokens and positions from 33 wallets, worth about $2.64 million at DefiPrime’s calculation.
Polymarket posted its first status update about unauthorized activity at 17:38 UTC and switched to cancel-only mode by 18:05 UTC. The company removed the script within the hour, cleared all caches, reset active sessions, and paused trading until the site was clean.
By October 30, 689 of 726 affected wallets had been fully refunded, and the remaining 37 were being processed. Polymarket is also paying $1.19 million to about 5,500 wallets that lost money during the trading pause or had positions taken, bringing total refunds to $3.9 million. Traders do not need to file a claim, but a status page form is available for anyone with a discrepancy.
DebugBear advised customers to remove its embed code, and Polymarket is re-adding third-party scripts with extra checks like Content Security Policy and Subresource Integrity. Researchers at Hudson Rock recommended keeping unneeded third-party code off trading pages and using SRI to reject changed files. Traders should reject any unexpected signing request.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
