Overview
Prediction market platform Polymarket briefly halted trading on its international platform on October 29, 2026 after attackers compromised a third-party provider and used it to serve crypto-draining JavaScript to users. Roughly $2.5 million to $2.7 million has been traced to an attacker-controlled wallet. Arkham tracked about $2.65 million.
Polymarket said: "One of our third party providers was compromised, and we have referred this to relevant law enforcement." Trading was restored after roughly 30 minutes by Polymarket's account (other outlets reported closer to an hour), and the company said it will reimburse every affected trader in full.
How the Attack Worked
| Detail | Finding |
|---|---|
| Compromised vendor | DebugBear, a website performance monitoring service, whose Real User Monitoring JavaScript was modified |
| Technique | Malicious script ran in the user's browser and hijacked authenticated trading sessions |
| Action | Liquidated users' prediction-market positions and sent proceeds to an attacker wallet |
| Smart contracts | Not touched; the script used trading permissions the victim's browser already held |
Because the script executed inside Polymarket's own origin, it needed no stolen keys and no phishing. Polymarket's production build metadata shows a later commit removing the DebugBear script.
A Recurring Pattern
This is not Polymarket's first third-party incident. In June a compromised vendor injected a wallet-draining script that took about $3 million from fewer than 15 accounts, and in May a private key compromise emptied roughly $700,000 from an internal top-up wallet. Cyber Kendra counts this as the third incident involving an outside provider since December 2025.
Defensive Takeaways
- Treat third-party scripts as part of your attack surface. Analytics, RUM, and monitoring tags run with full page privileges.
- Enforce a strict Content Security Policy with allowlisted script sources and outbound connection limits (
connect-src). - Use Subresource Integrity (SRI) for scripts that can be pinned; for vendor-hosted dynamic scripts, consider self-hosting or sandboxing them in an iframe on a separate origin.
- Remove vendor scripts from sensitive pages such as trading, checkout, and wallet-signing flows.
- Require transaction confirmation that a hijacked session cannot satisfy, such as wallet signature prompts showing the full action.
- Users: review recent activity on Polymarket and check for unexpected position sales or withdrawals.