Overview
On October 29, 2026, Polymarket halted trading on its international platform after users reported unauthorized withdrawals. The cause was a supply chain compromise: malicious JavaScript delivered through the real user monitoring (RUM) script of DebugBear, a UK-based website performance monitoring vendor.
What Happened
Polymarket switched to cancel-only mode and suspended relayer actions, then resumed trading about an hour later. Hudson Rock found a Polymarket production build timestamped 17:59 UTC with a change note removing the DebugBear script.
The injected code targeted logged-in Polymarket sessions. It located the user's trading tools and portfolio, then, depending on account type, either:
- sold positions and moved the proceeds, or
- sent position tokens to an attacker-controlled address.
Hudson Rock's review found the code reused authority already available in the authenticated app. It found no routine that transmitted passwords, seed phrases, or private keys.
Estimated Losses
No figure is officially confirmed, and Polymarket has not disclosed losses:
| Source | Estimate |
|---|---|
| Hudson Rock (hard-coded fallback address) | About $2.19 million, not a verified tally |
| GoPlus (710 deposit wallets, 731 addresses) | Roughly $2.71 million |
| Arkham (suspected attacker wallet) | About $2.65 million held |
The address count does not equal the victim count.
Vendor and Platform Response
- Polymarket says it identified and fixed the issue, that a third-party provider was compromised, and that it referred the matter to law enforcement. It pledged to reimburse affected traders. Its US platform was reportedly unaffected.
- DebugBear confirmed an "ongoing security incident," urged customers to remove its RUM snippet from their sites, and engaged specialist incident responders.
- How the script was tampered with is not yet known, and Hudson Rock found no sign that other DebugBear customers were targeted.
This is the second third-party script incident for Polymarket this year; a June compromise injected a malicious frontend script, with reported losses near $3 million.
Recommendations
- If you use DebugBear RUM, remove the snippet now and review browser-side logs for unexpected requests.
- Treat third-party scripts as privileged code. Any script on an authenticated page can act as the user.
- Deploy Content Security Policy and Subresource Integrity where possible; restrict
connect-srcso injected code cannot reach arbitrary endpoints. - Isolate sensitive flows. Avoid loading analytics and monitoring scripts on pages that can authorize transfers, and require re-authentication or confirmation for withdrawals.
- Users: review Polymarket positions and withdrawal history, and watch for official reimbursement guidance.
Sources
- SecurityWeek — $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack