On October 29, Polymarket suspended trading on its international platform after a supply chain attack via a compromised third-party provider, DebugBear, drained an estimated $2.1–2.7 million from users through malicious JavaScript injected into its frontend. The code exploited authenticated user sessions to sell positions or transfer tokens to an attacker-controlled address, without needing to steal private keys or credentials directly. Polymarket has since fixed the issue, resumed trading, and pledged to reimburse affected users, while DebugBear brought in specialist incident responders.
