Polymarket Loses Up to $2.7 Million After Third-Party Script Goes Rogue
Polymarket had a rough Tuesday. On October 29, users on its international platform started noticing money leaving their accounts without authorisation. Trading was suspended, relayer actions killed, and within an hour the prediction market was publicly blaming a compromised third-party vendor.
The company confirmed it had "identified and fixed" the issue, referred the matter to law enforcement, and promised to make affected traders whole. It declined to name the vendor or put a number on total losses. Both of those gaps have since been partially filled by outside researchers.
The compromised third party was DebugBear, a UK firm that sells website performance monitoring tools. Malicious JavaScript was served from a DebugBear address embedded in Polymarket's frontend. DebugBear confirmed it had been hit by an active security incident and told customers using its real user monitoring snippet to remove it immediately. The firm also brought in specialist incident responders.
Cybersecurity outfit Hudson Rock got hold of a copy of the rogue script. What it found was fairly surgical. The code scanned for authenticated user sessions, then either liquidated open positions and routed the proceeds, or transferred position tokens directly to an attacker-controlled wallet address. Notably, it did not appear to lift passwords, seed phrases, or private keys. It just hijacked authority that was already sitting in the logged-in session.
Hudson Rock also spotted a Polymarket production build timestamped 17:59 UTC with a commit note referencing the removal of the DebugBear script. Someone was moving fast to close the hole.
As for how much walked out the door, estimates differ. A screenshot reviewed by Hudson Rock showed roughly $2.19 million sitting at the script's hardcoded fallback address, though that figure is unverified. Blockchain security firm GoPlus, which independently attributed the attack to the same supply chain compromise, puts the number closer to $2.71 million, based on on-chain tracing across 710 deposit wallets and 731 addresses. Arkham data points to a suspected attacker wallet holding around $2.65 million, which happens to be the same address baked into the script.
Polymarket's US platform was apparently unaffected. Hudson Rock has not determined how the DebugBear script was tampered with, or how many individual users were hit. There is also no indication that other DebugBear customers were targeted.
This is not Polymarket's first rodeo with dodgy third-party scripts. In June, the platform disclosed a separate frontend compromise involving a malicious injected script, with losses reported at around $3 million. Two supply chain attacks in under six months is not a great look for any platform handling real money.
The timing was also unfortunate in a broader sense. The same day Polymarket was scrambling to contain the damage, Binance was reportedly dealing with a roughly $6 billion hack attributed to North Korean state actors. A busy day for crypto incident response teams everywhere.