← Polymarket

2026 Polymarket — malicious script delivered through a DebugBear monitoring embed hijacked logged-in trading sessions; about $2.5M traced to an attacker wallet

2026 Unknown records affected Share on X

Data compromised

Logged-in trading sessions, prediction-market positions and crypto balances for affected users. The script was built to sell or transfer positions and move assets to an attacker wallet. Polymarket has not disclosed how many users or wallets were affected, how much was taken, or how reimbursement will work.

Technical writeup

Polymarket confirmed a security incident involving a compromised third-party provider and said it referred the matter to law enforcement. The malicious script was active on October 29, 2026, between about 1:50 and 1:56 p.m. ET according to on-chain activity reported by BleepingComputer. About $2.5 million was traced to a suspected attacker wallet, which Hudson Rock identified in the code. BleepingComputer’s own tally of about 28.6 million POL moved between wallets differs from that figure, so the amount is not reconciled. The article also notes that DebugBear’s role as both distributor and command-and-control server raises open questions about how far attackers reached into Polymarket’s systems. recordsAffected 0 because no user count has been published.

Root cause

A compromised third-party provider. A JavaScript embed from DebugBear, a website performance-monitoring service (its Real User Monitoring component), carried a malicious script. Polymarket said a third-party provider was compromised, removed the DebugBear script at 1:59 p.m. ET and moved its exchange to cancel-only mode at 2:05 p.m. ET. The issue was marked resolved at 3:05 p.m. ET, and trading resumed about an hour after the initial pause.

References

Breaches you may like