Polymarket suspends trading after crypto-draining script breach, about $2.5M traced to suspected attacker wallet
Polymarket says a third-party provider was compromised to distribute malicious JavaScript; trading resumes after about one hour, company promises full reimbursement
Prediction market platform Polymarket temporarily suspended trading on Thursday after hackers compromised a third-party service to distribute cryptocurrency-draining JavaScript, with approximately $2.5 million in assets traced to a suspected attacker wallet. The company said it had fixed the issue and referred the breach to law enforcement, promising to make affected users whole.
Polymarket placed its exchange into cancel-only mode at 2:05 p.m. ET on Thursday and paused relayer actions while investigating the security incident. At 2:37 p.m. the company announced the issue had been fixed and that trading was temporarily halted out of an abundance of caution. Trading resumed approximately one hour after the initial suspension, with the incident marked resolved at 3:05 p.m. ET.
The breach involved malicious JavaScript distributed through cdn.debugbear[.]com/C7xcKKrjUnXK.js, hosted on infrastructure belonging to DebugBear, a website performance-monitoring service. DebugBear confirmed it is investigating an ongoing security incident and warned customers to remove its monitoring JavaScript from their websites. "We're impacted by an ongoing security incident," DebugBear said on X. At the time of writing, DebugBear's website was inaccessible, displaying a Cloudflare error.
Security researchers at Hudson Rock identified a suspected attacker-controlled wallet (0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18) embedded in the malicious script. Analysis of the wallet's blockchain activity by BleepingComputer found that it transferred approximately 28.6 million POL, valued at roughly $2.57 million, to three additional wallets. Blockchain records show the wallet conducted numerous transactions involving Polymarket's prediction-market token contract between 1:50 p.m. and 1:56 p.m. ET, shortly before the exchange suspended trading.
BleepingComputer analyzed a copy of the malicious JavaScript and found it was designed to hijack authenticated Polymarket trading sessions, liquidate users' prediction-market positions, and transfer cryptocurrency and other assets to the attacker-controlled wallet. The malware checked whether a visitor was logged into Polymarket and attempted to use their existing trading session and the platform's trading functionality to carry out unauthorized transactions. It then checked the user's cryptocurrency balances and prediction-market positions to determine the value of their holdings.
Depending on how the user authenticated, the malware tried to automatically sell their prediction-market positions or transfer their tokens directly to the attacker-controlled wallet. The script also attempted to convert users' cryptocurrency holdings into assets that could be transferred, using Polymarket's existing transaction functionality. BleepingComputer found that the malicious script communicated with data.debugbear.com to receive instructions and send data about targeted accounts, wallet addresses, balances, and transaction results.
Hudson Rock researchers discovered Polymarket production build metadata containing the commit message “chore(polymarket): remove debugbear rum script (#15337)”, indicating the platform had removed the DebugBear monitoring integration. The build was timestamped October 29 at 1:59 p.m. ET, shortly before Polymarket publicly announced the incident.
Polymarket has not disclosed how many users were affected, how much cryptocurrency was stolen, or how the reimbursement process will work.
Polymarket was compromised by an unknown Threat Actor. Over 1,000,000 users have been cryptodrained in the past hour.
Throwback to when Polymarket mocked Threat Actors for enumerating their infrastructure and building targets.
The breach of a well-known prediction market platform raises concerns about the security of third-party integrations in crypto services and the potential for supply-chain attacks.
Approximately $2.5 million in user assets were drained, highlighting the real financial risk to crypto traders from compromised JavaScript dependencies.
The incident may prompt regulators and platforms to scrutinize third-party monitoring tools and their access to sensitive trading sessions.
Background
Polymarket is a decentralized prediction market platform that allows users to bet on the outcomes of real-world events using cryptocurrency. The platform gained significant attention during the 2024 US presidential election cycle. Thursday's breach involved DebugBear, a website performance-monitoring service that embeds JavaScript to collect visitor metrics. Attackers compromised that script to target Polymarket users.
What to Watch
Whether Polymarket provides a detailed post-mortem and discloses the number of affected users and the total amount stolen.
DebugBear's investigation: the extent of the attacker's access to its infrastructure and whether other clients were affected.
Any law enforcement actions or the freeze of the suspected attacker wallet.
12 claims in this story checked against 1 source: 12 supported.
Show each claim
SupportedPolymarket suspended trading on Thursday after a third-party service was compromised to distribute cryptocurrency-draining JavaScript.BleepingComputer: “Prediction market platform Polymarket temporarily suspended trading on Thursday after hackers compromised a third-party service to distribute cryptocurrency-draining JavaScript”
SupportedAbout $2.5 million in assets was traced to a suspected attacker wallet.BleepingComputer: “with approximately $2.5 million in assets traced to a suspected attacker wallet.”
SupportedPolymarket said it had fixed the issue and referred the breach to law enforcement.BleepingComputer: “The company confirmed the security incident, saying it had identified and fixed the issue affecting its international platform, Polymarket.com, and referred the breach to law enforcement.”
SupportedPolymarket promised to fully reimburse affected traders.BleepingComputer: ““We'll make this right and are fully reimbursing all affected traders.””
SupportedPolymarket put the exchange into cancel-only mode at 2:05 p.m. ET and paused relayer actions.BleepingComputer: “Polymarket initially placed its exchange into cancel-only mode at 2:05 p.m. ET and paused relayer actions while investigating the incident.”
SupportedAt 2:37 p.m., Polymarket announced that the issue was fixed and trading was halted out of caution.BleepingComputer: “At 2:37 p.m., the company announced that the issue had been fixed and that trading was temporarily halted out of an abundance of caution.”
SupportedTrading resumed approximately one hour after the initial suspension, and the incident was marked resolved at 3:05 p.m. ET.BleepingComputer: “Trading resumed approximately one hour after the initial suspension, with the incident marked resolved at 3:05 p.m. ET.”
SupportedDebugBear said, “We're impacted by an ongoing security incident.”BleepingComputer: ““We're impacted by an ongoing security incident,” DebugBear said in a post on X .”
SupportedThe malicious JavaScript was distributed from the stated cdn.debugbear URL and hosted on DebugBear infrastructure.BleepingComputer: “Security researchers at Hudson Rock identified malicious JavaScript distributed through cdn.debugbear[.]com/C7xcKKrjUnXK.js”
SupportedThe suspected attacker wallet transferred about 28.6 million POL, worth roughly $2.57 million, to three other wallets.BleepingComputer: “BleepingComputer's examination of the wallet's blockchain activity found that it transferred approximately 28.6 million POL, valued at roughly $2.57 million, to three additional wallets.”
SupportedThe wallet made transactions involving Polymarket's prediction-market token contract between 1:50 p.m. and 1:56 p.m. ET, before trading was suspended.BleepingComputer: “Blockchain records also show that the wallet conducted numerous transactions involving Polymarket's prediction-market token contract between 1:50 p.m. and 1:56 p.m. ET, shortly before the exchange suspended trading.”
SupportedBleepingComputer found the script was designed to hijack authenticated trading sessions, liquidate positions, and transfer cryptocurrency and other assets.BleepingComputer: “BleepingComputer analyzed a copy of the malicious JavaScript file ( VirusTotal ), finding that it was designed to hijack authenticated Polymarket trading sessions, liquidate users' prediction-market positions, and transfer cryptocurrency and other assets to an attacker-controlled wallet.”
