Polymarket breach: compromised third-party script drained traders' assets, full reimbursement promised
Polymarket confirmed on October 29, 2026 that a compromised third-party provider’s script drained cryptocurrency and prediction-market holdings from logged-in users of its international platform; trading was halted for about an hour, the company says affected traders will be fully reimbursed, and researchers traced about $2.5 million to a suspected attacker wallet.
What happened
On Thursday, October 29, 2026, Polymarket confirmed that one of its third-party providers had been compromised and used to distribute malicious JavaScript to users of its international platform, Polymarket.com. “One of our third party providers was compromised, and we have referred this to relevant law enforcement,” the company said, adding that anyone impacted “will be made whole.” Polymarket placed its exchange into cancel-only mode at 2:05 p.m. ET and paused relayer actions while it investigated; at 2:37 p.m. it announced the issue had been fixed while trading stayed temporarily halted, and trading resumed at about 3:05 p.m. ET with the incident marked resolved.
Security researchers at Hudson Rock identified the malicious script as one served from the infrastructure of DebugBear, a website performance-monitoring service whose Real User Monitoring (RUM) JavaScript is embedded in customer websites to collect performance metrics. DebugBear has confirmed it is investigating an ongoing security incident and told customers who use its RUM product to remove the embed code from their websites. BleepingComputer analysed a copy of the script and found it was designed to hijack the trading session of a logged-in Polymarket visitor, liquidate the user’s prediction-market positions and transfer cryptocurrency and other assets to an attacker-controlled wallet. It also communicated with the attackers’ server, sending data about targeted accounts — wallet addresses, balances and transaction results. Polymarket’s production build records, found by Hudson Rock, show the DebugBear integration being removed in a build timestamped 1:59 p.m. ET on October 29, shortly before the company’s public announcement.
Who is affected
Traders who were logged in to Polymarket’s international platform, Polymarket.com, while the malicious script was live. Polymarket has not disclosed how many users were affected, how much cryptocurrency was stolen in total, or how the reimbursement process will work. BleepingComputer’s examination of blockchain activity around a suspected attacker-controlled wallet identified by Hudson Rock found that it transferred approximately 28.6 million POL, valued at roughly $2.57 million, to three additional wallets, and that it conducted numerous transactions involving Polymarket’s prediction-market token contract between 1:50 p.m. and 1:56 p.m. ET, shortly before the exchange suspended trading. Hudson Rock reported that the suspected attacker wallet held approximately $2.19 million in cryptocurrency at the time of its investigation.
How serious
This was direct theft of assets, not just a data exposure: the script used victims’ own signed-in sessions and the platform’s normal trading functions to sell their positions and move their money, so no password or wallet recovery phrase had to be stolen for the assets to leave. Polymarket has promised that affected traders are being “fully reimbursed” — that promise, once delivered, is what stands between affected users and the loss. The second risk starts now: scammers will imitate the reimbursement, sending fake “claim your refund” messages designed to get traders to connect a wallet, sign a malicious transaction or reveal a recovery phrase. The compromise also reached beyond Polymarket itself: any website embedding the same monitoring script was served by the same compromised provider, which is why DebugBear’s warning to remove the code went to all of its RUM customers, not just to Polymarket.
What to do now
Wait for Polymarket’s official reimbursement process, and reach it only through the company’s official website or app — never through a link in an email, text, direct message or social-media reply. A reimbursement never requires your wallet recovery phrase (seed phrase) or private key; anyone asking for one is stealing, not refunding. Do not sign wallet transactions or approve token allowances offered by “support” accounts or refund pages. Check your Polymarket account history for trades or transfers you did not make on October 29, and keep your own records of your balances and positions in case you need them for the reimbursement.
Sources: BleepingComputer, October 29, 2026 · Reuters, October 29, 2026 (syndicated report)