Polymarket Halts Operations After Supply Chain Attack

On October 29, the prominent cryptocurrency prediction platform Polymarket fell victim to a devastating cyberattack, leading to significant financial losses for its user base. The company officially confirmed that a sophisticated breach compromised a third-party service provider, forcing an immediate, temporary suspension of all trading activities. While Polymarket has pledged full restitution to affected individuals, initial estimates suggest the damages already stretch into the millions of dollars. Detailed information regarding the operational freeze can be found in the Reuters report on the Polymarket trading suspension.

The crisis enveloped the international Polymarket exchange, a digital arena where speculators trade contracts based on the outcomes of political elections, sporting events, and cultural phenomena. Following alarming reports of unauthorized capital extraction, administrators drastically restricted platform functionality. Users were temporarily permitted only to cancel pre-existing orders, while all new trades and intermediary service operations were strictly prohibited. Polymarket subsequently announced that it had neutralized the vulnerability and officially resumed standard trading operations.

The Anatomy of the Supply Chain Compromise

Preliminary forensic investigations point directly toward the compromise of DebugBear, an external service utilized for website performance monitoring. DebugBear’s “Real User Monitoring” tool is designed to harvest data regarding page load velocities and web application responsiveness directly within visitors’ browsers. DebugBear publicly acknowledged the security incident, urgently advising its clientele to purge the embedded monitoring code from their respective websites until a comprehensive investigation concludes.

Cybersecurity specialists at Hudson Rock meticulously dissected the script emanating from DebugBear’s compromised infrastructure. Their analysis revealed sinister, embedded functions entirely unrelated to performance metrics. Instead of passively collecting statistics, the injected malware actively hunted for active Polymarket trading sessions. Once identified, it scrutinized the user’s portfolio and aggressively attempted to hijack the mechanisms responsible for order placement and cryptographic transaction signing. For a deep dive into the malicious script’s behavior, refer to the Infostealers technical breakdown of the Polymarket breach.

The malware’s execution varied depending on the victim’s specific account type. It attempted to either directly siphon tokens to a perpetrator-controlled address or, alternatively, liquidate open positions before extracting the resulting capital. To execute these illicit operations, the program forged digital signature requests adhering to the EIP-712 standard on the Polygon network, attempting to route these fraudulent commands through Polymarket’s legitimate infrastructure.

The Insidious Nature of the Attack

The methodology of this attack was particularly treacherous. Because the malicious code loaded as an integral component of the authentic Polymarket website, victims did not need to visit a deceptive phishing page. Instead, a seemingly routine signature request would materialize on their screen, perfectly masquerading as standard wallet interaction. Approving this deceptive prompt authorized the irreversible transfer of assets to an unauthorized recipient. However, security researchers have not yet confirmed whether all illicit signature and withdrawal attempts were successfully executed by the attackers.

Blockchain analysts monitoring the situation identified a highly suspicious wallet accumulating approximately $2.65 million worth of POL assets. Observers meticulously documented numerous conversions from USDC.e to POL utilizing the Relay service, followed by complex lateral movements of the funds across various addresses. Analysts can track these movements through the Arkham Intelligence explorer. Nevertheless, this identified balance cannot yet be definitively declared as the total sum stolen. Polymarket has refrained from publishing the official financial magnitude of the damages or the precise number of impacted victims.

Individual traders, however, are reporting catastrophic losses. A speculator operating under the pseudonym “Car” publicly lamented the vanishing of $800,000 from their account, noting that all their open positions were simultaneously liquidated. According to this victim, a close associate suffered an additional $600,000 loss. While independent verification of these specific figures remains pending, the described mechanics align perfectly with the known capabilities of the deployed malware.

Technical scrutiny revealed that the suspicious 15,187-byte JavaScript file remained accessible on DebugBear’s servers during the evening of October 29. Researchers successfully downloaded identical copies of the malicious payload on two separate occasions. Concurrently, a published Polymarket software build contained a distinct commit logging the removal of the DebugBear integration, timestamped at 17:59:20 UTC. Subsequent evaluations of the platform’s homepage confirmed the eradication of the dangerous script. However, the security status of previously opened browser tabs and locally cached copies of the code could not be independently verified.

Polymarket’s Response and Ongoing Security Concerns

Polymarket has firmly committed to compensating all financially damaged users and has officially escalated the incident to law enforcement agencies within the United Kingdom. The organization has not yet elucidated how the assailants breached the third-party component, the exact duration the malware resided on the platform, or which specific user demographics faced the highest exposure risk.

Cybersecurity experts strongly advise crypto wallet holders to remain extraordinarily vigilant. Users must never blindly approve unexpected signature requests and should meticulously audit their transaction histories, open positions, and any previously granted token approvals. Crucially, if a wallet interacted with the compromised code, merely disconnecting from the website is insufficient; users must actively revoke the permissions indelibly recorded on the blockchain. These sophisticated asset-extraction tools are commonly referred to as “crypto drainers.” Furthermore, victims must remain wary of opportunistic scammers falsely offering recovery services for stolen funds.

Alarmingly, this crisis marks the second major supply-chain compromise Polymarket has suffered in mere months. On June 25, 2026, cybercriminals successfully injected malicious JavaScript into the platform following the breach of a different contractor. In that previous instance, the analytics firm AMLBot calculated the damages at approximately $3.1 million, affecting at least 11 individual wallets. You can review the historical context in this CoinDesk report on the previous Polymarket hack. Polymarket swiftly removed the compromised dependency and honored its promise to fully reimburse the victims.

The recurrence of this specific attack vector starkly illuminates the inherent perils of integrating third-party JavaScript within sensitive financial ecosystems. Even a seemingly benign performance-tracking tool possesses the profound capability to execute arbitrary code within a visitor’s browser. When malicious actors successfully subvert such a component, they endanger not only user data but the very financial transactions the web application facilitates through connected digital wallets.