Real

Million

Four

Polymarket

Polymarket suffered a security breach on October 29 that drained approximately $2.7 million from hundreds of user wallets after attackers compromised a third-party monitoring service and injected malicious code into the prediction market platform’s website.
The attack targeted Polymarket’s international trading interface through DebugBear, a website performance monitoring provider whose compromised JavaScript was used to execute unauthorized transactions. Blockchain analysis identified 737 affected accounts and approximately $2.73 million in losses, with funds transferred through Polymarket’s existing withdrawal infrastructure.
Polymarket temporarily suspended trading, disabled transaction processing and removed the affected integration before restoring operations. The company has <a href="https://x.com/PolymarketTrade/status/2115874609014726842" rel="noopener noreferrer nofollow">confirmed the security incident</a>, referred the matter to UK law enforcement and pledged to reimburse all affected traders.
The breach did not involve a confirmed vulnerability in Polymarket’s smart contracts, but instead exploited software delivered through a trusted third-party service.
<h2 id="compromised-debugbear-script-drains-hundreds-of-polymarket-wallets">Compromised DebugBear Script Drains Hundreds of Polymarket Wallets</h2>
The attack originated from malicious JavaScript distributed through DebugBear’s Real User Monitoring (RUM) infrastructure, a service used by websites to monitor performance and user activity.
Security researchers discovered that the compromised script contained <a href="https://cryptoadventure.com/crypto-wallet-drainers-explained/" rel="noopener noreferrer nofollow">wallet-draining functionality</a> capable of interacting with authenticated Polymarket trading sessions. Once loaded into a user’s browser, the malicious code could inspect account balances, identify open positions and initiate unauthorized asset transfers.
The script attempted to liquidate prediction market positions and redirect cryptocurrency holdings to an attacker-controlled address using Polymarket’s existing transaction infrastructure.
Unlike a conventional smart contract exploit, the attack did not require breaking the underlying blockchain contracts. Instead, it abused legitimate trading and withdrawal functions after gaining access through the website’s frontend.
DebugBear acknowledged a security incident affecting its infrastructure and <a href="https://x.com/DebugBear/status/2115866496643535293" rel="noopener noreferrer nofollow">urged customers using its monitoring service</a> to remove the embedded JavaScript from their websites.
Polymarket subsequently removed the compromised dependency, with its production build showing an update specifically targeting the DebugBear monitoring integration.
The incident resembles a <a href="https://cryptoadventure.com/polymarket-to-refund-users-after-vendor-script-drains-2-94m/" rel="noopener noreferrer nofollow">June attack that drained approximately $2.94 million from Polymarket users</a>, when another compromised third-party dependency allowed malicious code to reach the platform’s frontend.
Both incidents highlight how external software integrations can expose user assets even when a platform’s core smart contracts remain operational.
<h2 id="blockchain-analysis-traces-2-73-million-from-737-accounts">Blockchain Analysis Traces $2.73 Million From 737 Accounts</h2>
The <a href="https://bitquery.io/investigations/polymarket-hack" rel="noopener noreferrer nofollow">October 29 transaction trail</a> identified 737 affected Polymarket accounts and approximately $2.73 million in unauthorized withdrawals between 17:10 and 18:10 UTC.
Investigators tracked 985 individual draining transactions during the period, with the largest concentration occurring between 17:25 and 18:10 UTC. At peak activity, as many as 40 transactions were recorded within a single minute.
Four accounts accounted for approximately 43% of the identified losses, while hundreds of smaller wallets were also affected.
The transfers moved through Polymarket’s legitimate relayer infrastructure using valid transaction authorizations. The stolen assets were subsequently exchanged for POL, Polygon’s native cryptocurrency, before being distributed across additional wallets.
A principal receiving address, <a href="https://polygonscan.com/address/0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18" rel="noopener noreferrer nofollow">0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18</a>, accumulated approximately 28.6 million POL during the incident.
The attacker later transferred funds into three additional wallets, with some assets routed toward Ethereum through cross-chain bridging services.
At 19:49 UTC, approximately $2.17 million of the traced funds remained on Polygon, while other proceeds had begun moving across networks.
The on-chain investigation also identified one additional withdrawal worth approximately $11 at 19:11 UTC, after Polymarket had announced that the underlying issue was fixed. The transaction involved an account previously affected by the attack, raising questions about whether all malicious authorizations had been neutralized immediately.
Polymarket has not independently confirmed the $2.73 million loss estimate or the reported number of affected accounts.
<h2 id="polymarket-restores-trading-and-promises-full-reimbursements">Polymarket Restores Trading and Promises Full Reimbursements</h2>
Polymarket initially moved its international exchange into cancel-only mode at approximately 18:05 UTC, allowing users to cancel existing orders while preventing new trades and pausing relayer operations.
The platform identified and removed the compromised integration before announcing that the vulnerability had been addressed at 18:37 UTC.
Trading resumed at approximately 19:05 UTC, ending a one-hour interruption. The separate Polymarket US platform was not reported to be affected.
Polymarket has pledged to compensate all affected traders, although it has not disclosed the number of eligible users, the reimbursement timetable or whether any stolen funds have been recovered.
The company has also referred the incident to UK law enforcement, where DebugBear is based, as investigators work to establish how the monitoring provider’s infrastructure was compromised.
The breach adds to a difficult period for cryptocurrency platform security. On the same day, <a href="https://cryptoadventure.com/binance-hack-6-3b-affected-3b-in-assets-frozen/" rel="noopener noreferrer nofollow">Binance confirmed a $6.3 billion security breach, with approximately $3 billion in assets frozen</a> following unauthorized transfers across multiple blockchains.
There is no evidence linking the two incidents, and their suspected attack methods differ substantially.
For Polymarket, the latest exploit raises renewed questions about third-party dependencies and the protections surrounding browser-based cryptocurrency transactions.
Even without direct access to users’ private keys or a vulnerability in the underlying smart contracts, malicious code delivered through a trusted website integration was able to trigger unauthorized trades and withdrawals.
Polymarket has restored normal trading and committed to covering user losses, but a complete technical explanation of the DebugBear compromise, the final financial impact and the recovery process remains outstanding.
The post <a href="https://cryptoadventure.com/polymarket-hack-drains-2-7m-from-737-wallets/" rel="noopener noreferrer nofollow">Polymarket Hack Drains $2.7M From 737 Wallets</a> appeared first on <a href="https://cryptoadventure.com" rel="noopener noreferrer nofollow">Crypto Adventure</a>.

Polymarket Hack Drains $2.7M From 737 Wallets

Table of Contents

Crypto Adventure

Other articles published on Oct 30, 2026

Join our free newsletter for daily crypto updates!