Prediction market platform Polymarket briefly halted trading on its international exchange on Thursday, October 29, after users reported unauthorized withdrawals from their wallets. Blockchain analytics firms Betting Intelligence and Polysights estimated that attackers took about $2.7 million from 710 wallets.
The incident involved a compromised third-party performance-monitoring script supplied by DebugBear, a UK-based website performance vendor whose code ran on Polymarket.com.
How the DebugBear Script Was Abused
In its post-incident update, Polymarket said the attacker replaced DebugBear’s monitoring script with malicious code designed to target its users. For users who had Polymarket open during a short window, the script used their active sessions to sell trading positions and move funds out of their wallets.
The incident didn’t involve a reported breach of Polymarket’s smart contracts; instead, attackers reportedly abused a trusted third-party script running on the website. Polymarket removed the compromised code, cleared its caches, paused trading and relayer actions, and reset active login sessions.
The platform moved into cancel-only mode at around 2:00 p.m. ET and resumed trading at 3:00 p.m. ET. Its separate US platform was not affected. DebugBear acknowledged an “ongoing security incident” and asked customers using its real-user monitoring (RUM) product to remove the embedded code.
Refunds and Law Enforcement Response
Polymarket referred the incident to UK law enforcement and pledged to reimburse affected traders. By Friday afternoon, it said 95% of affected wallets had been refunded. The company said it was returning $3.9 million in total: $2.7 million for stolen funds and another $1.2 million to cover losses linked to the trading pause.
“In total, we’re returning $3.9M to traders: the $2.7M plus $1.2M to cover pause-related losses. No claims or tickets needed: we identified eligible wallets from on-chain and trading data,” the company stated in its update.
Users whose losses were below $10,000 were due to receive refunds by October 30, while those with larger losses were asked to complete a release form.
The incident came days before the November 3 US midterm elections, when prediction markets expected higher trading volumes. It was also Polymarket’s second reported third-party website compromise this year.
In April, the platform rejected a hacker’s claim of stealing more than 300,000 user records, arguing that the information was already publicly accessible through its APIs and blockchain data. Then in June, attackers used malicious code injected through a vendor to steal about $3 million from users.
Expert’s Commentary
Security professionals note that managing third-party web scripts remains a tough problem for online platforms. In comments shared with Hackread.com, Gareth Bowker, Head of Information Security at Jscrambler, explained why standard web protections often fail in these scenarios:
“The malicious script exchanged data with a server on DebugBear’s own domain. A content security policy that permits a trusted vendor’s domain would have allowed that traffic. Subresource integrity checks are also of limited use for real-user monitoring scripts, because vendors update those scripts frequently. Static controls are necessary, but they are not sufficient on their own. Organizations also need to monitor what third-party code does in the browser at runtime.”
Bowker also discussed what steps traders should take following the incident, stating, “Polymarket’s prompt decision to halt trading, and its commitment to reimburse affected traders in full, should limit the losses for users. Users should still review their transaction history and revoke any token approvals they do not recognize. A user cannot reasonably detect a malicious script on a trusted site. Control over what runs on that site is the platform’s responsibility.”
Click Here For The Original Source.
——————————————————–
