Polymarket Resumes Trading After Malicious Script Targets User Assets
Summary
Polymarket confirmed a third-party provider compromise that distributed JavaScript targeting users’ trading sessions and crypto assets. Trading briefly halted and resumed; the amount stolen and number of affected users remain undisclosed.
Key points
- Polymarket said a third-party provider was compromised; it temporarily halted trading while investigating, then fixed the issue and resumed trading.
- Researchers identified malicious JavaScript distributed through DebugBear’s Real User Monitoring service.
- The script checked for authenticated Polymarket sessions and attempted to sell users’ prediction-market positions or transfer tokens and cryptocurrency to an attacker-controlled wallet.
- BleepingComputer’s analysis found the script communicating with data.debugbear[.]com to receive instructions and send targeted-account and transaction information.
- Researchers identified a suspected attacker-controlled wallet; blockchain analysis found approximately 28.6 million POL, valued at about $2.57 million, transferred from it to three other wallets.
- Polymarket said affected traders would be reimbursed, but it has not disclosed the number of affected users, the amount of cryptocurrency stolen, or how reimbursement will work.
- DebugBear said it was investigating a security incident and advised customers using its RUM product to remove the embedded JavaScript.
Article Details
- Victim Organization
- Polymarket
- Victim Domain
- Polymarket.com
- Incident Type
- A third-party service was compromised to distribute malicious JavaScript that hijacked authenticated trading sessions and attempted to liquidate or transfer users’ cryptocurrency and prediction-market assets.
- Incident Date
- 2026-10-29
- Disclosure Date
- 2026-10-29
- Data Types Exposed
- Targeted account information
- Wallet addresses
- Balances
- Transaction results
- Affected Records
- Not disclosed; the number of affected users is unknown.
- Operational Impact
- Polymarket placed the exchange in cancel-only mode, paused relayer actions, and temporarily halted trading. Trading resumed approximately one hour after the initial suspension; the incident was marked resolved at 3:05 p.m. ET. The amount of cryptocurrency stolen, if any, was not disclosed. Approximately 28.6 million POL, valued at roughly $2.57 million, was traced from a suspected attacker wallet to three other wallets.
- Ransom Or Extortion
- None reported. Polymarket said it would reimburse affected traders.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | data[.]debugbear[.]com | DebugBear host used by the malicious script as a command-and-control and data-exfiltration server. |