Polymarket hack drains about $2.7M via compromised vendor script
Polymarket paused trading on Oct 29 after malicious code in a third-party monitoring script drained about $2.7 million from roughly 700 user accounts.
SECURITY & HACKSNEWS
Lukas Brenner
10/30/20261 min read
Prediction market Polymarket briefly halted trading on its international platform on October 29 after attackers used a compromised third-party script to drain an estimated $2.7 million from user accounts. Blockchain data provider Bitquery put unauthorized withdrawals at about $2.73 million across 737 accounts, while other investigators counted around 700 affected wallets.
According to Bitquery's timeline, the withdrawals ran from roughly 17:10 to 18:10 UTC. Polymarket switched its international exchange to cancel-only mode and suspended relayer operations at about 18:05 UTC, said it had found and fixed the problem shortly after, and reopened trading around 19:05 UTC. Bitquery later flagged one more unauthorized withdrawal after the fix was announced.
A vendor, not a contract bug
The malicious code arrived through website monitoring tools embedded in Polymarket's frontend rather than through its smart contracts. Researchers linked the injection to DebugBear, a web performance monitoring company, which separately disclosed a security incident and told customers to remove its Real User Monitoring scripts. Hudson Rock identified the code, and BleepingComputer reported that it hijacked logged-in sessions, checked balances and tried to sell positions or move assets to attacker-controlled wallets.
Polymarket's own statement referred only to a compromised third-party provider. The company said affected users would be made whole and that it had referred the matter to law enforcement in the United Kingdom, but it has not given a reimbursement timeline, a final loss figure or a full post-mortem. Its separate US-regulated exchange was not reported as affected.
Bitquery traced the stolen funds being swapped into POL and dispersed across new addresses, with part of the haul bridged to Ethereum. Analytics firms tied about $2.65 million to a single suspected attacker wallet.
The incident is the platform's second third-party breach this year, following a June case that reportedly cost users about $3 million. It also lands in a week dominated by the record Binance theft, and highlights how web front ends and outside scripts have become a weak point even where on-chain code holds up.
Source: Bitquery, The Block, BleepingComputer, Altcoin Buzz, Gate News