Polymarket paused trading on October 29 after attackers slipped crypto-draining JavaScript onto its site through a compromised outside provider. BleepingComputer traced about $2.5 million in assets to a suspected attacker wallet, and the security firm Hudson Rock found the same address embedded in the malicious script. Polymarket says affected traders will be reimbursed in full.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
The script ran in the browsers of logged-in users and tried to use their live sessions to sell positions or move tokens. The exchange has not disclosed how many accounts were touched or how much was taken in total.
Timeline of the halt on October 29
The sequence, reconstructed from Polymarket’s status page, begins at 2:05 p.m. Eastern, when the exchange went into cancel-only mode and paused relayer actions to investigate. At 2:37 p.m. it announced the issue was fixed and that trading was temporarily halted as a precaution. Trading resumed about an hour later, and the incident was marked resolved at 3:05 p.m. The page attributes the problem to a compromised third-party provider, says the matter was referred to law enforcement, and promises that anyone impacted will be made whole.
The on-chain trail starts before the halt. BleepingComputer’s timeline shows the attacker-linked wallet making numerous transactions involving Polymarket’s prediction-market token contract between 1:50 and 1:56 p.m. Eastern, then the production build with the DebugBear removal at 1:59 p.m., then the move to cancel-only mode at 2:05 p.m. DebugBear’s own website was returning a Cloudflare error when BleepingComputer checked, and it was unclear whether that was part of containment.
In a post on X, the company said trading was fully back online and that it was fully reimbursing all affected traders. It has not said how reimbursement will work, how many traders qualify or how the total will be funded.
DebugBear’s script and what it did in the browser
The malicious file was served from infrastructure belonging to DebugBear, a website performance-monitoring company whose Real User Monitoring product embeds JavaScript in customer sites to collect timing data from visitors. DebugBear said on X that it was impacted by an ongoing security incident and asked customers using the monitoring product to remove its embed code. Polymarket’s production build, stamped 17:59 UTC, carries a commit message removing the DebugBear script, about six minutes before the exchange entered cancel-only mode.
According to BleepingComputer’s analysis, the script checked whether a visitor was logged in, then used the existing trading session to estimate holdings from crypto balances and prediction-market positions. Depending on how the user had authenticated, it either sold positions automatically or sent prediction-market tokens straight to an attacker-controlled wallet, and it reported targets, balances and results to a DebugBear data endpoint. Using the same vendor’s infrastructure for delivery and command-and-control raises questions about how deep the intruders’ access to DebugBear went.
A monitoring script is trusted by design: it loads on every page view with the same privileges as the site’s own code, so a poisoned copy inherits whatever the visitor’s session can do. Browsers cannot tell the difference, which is why the damage depended on who happened to be logged in during the window.
Counting the $2.5 million
Hudson Rock’s write-up retrieved the script twice and got identical 15,187-byte files with the same hash. The firm found the recipient address inside the code, and a PolygonScan screenshot it reviewed showed roughly $2.19 million there. Hudson Rock cautions that screenshot values are not verified proceeds of theft, and that the initial compromise method, the number of victims and the total loss all remain unconfirmed.
Polymarket has been through something similar. The Defiant reported in June that the platform confirmed about $3 million drained in a front-end supply-chain breach, with a third-party vendor injecting malicious code into the website and refunds pledged to fewer than 15 affected accounts. The October incident differs in its vendor and in the script Hudson Rock recovered, and the two should not be combined, but a second case within months raises the question of how Polymarket vets code that loads from outside its own servers.
BleepingComputer’s own tracing of the attacker-linked wallet found it had sent about 28.6 million POL, worth roughly $2.57 million, on to three further wallets, and that movement is the basis for the $2.5 million figure. The script itself is catalogued on VirusTotal. Hudson Rock also notes that an earlier report of about $3 million stolen belongs to a separate June 25 incident and should not be added to this one.
Three numbers are still missing: victims, total losses and the reimbursement bill. DebugBear’s request that customers pull its embed code also implies that other sites carried the same monitoring script, and none of them has been named. Polymarket and DebugBear had not answered BleepingComputer’s questions when the report ran, so the $2.5 million is a floor for what moved, not a measured loss.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Common allergy, bladder and sleep pills tied to sharply higher dementia odds
- NOAA now gives this winter a 75% chance of the strongest El Nino since 1950
- Doctors warn a silent liver disease now affects one in three American adults
- The FBI told the rest of ShinyHunters to surrender after a 24-year-old was arrested
