Polymarket Hacked via DebugBear Script, Vendor Confirms Breach

Polymarket froze trading on its international prediction market on 29 October 2026 after malicious code delivered through a third-party script on Polymarket.com drained users’ accounts. One trader reported losing about $800,000. The company said one of its third-party providers had been compromised and promised to compensate every affected user. It has not said how many accounts were hit or how much money was taken.

According to the report, users began reporting drained wallets around 17:30 UTC (11:00 pm IST) on Thursday. Their shares had been sold without permission, and their balances had been moved out. At 18:05 UTC, Polymarket’s status page logged a major outage on its Predictions Trading API, the central limit order book (CLOB) that matches buy and sell orders.

The exchange moved to cancel-only mode: traders could withdraw existing orders but not place new ones. Polymarket also paused its relayer, the service that submits users’ signed transactions to the Polygon blockchain. BNO reported that trading resumed at 3 pm ET (12:30 am IST on Friday).

“If you are a Polymarket user, lock down your account,” trader Car (@CarOnPolymarket) wrote on X. He said he had been drained of $800,000, that all his positions were sold, and that a friend lost around $600,000. Chinese outlet Odaily, as cited by Binance News, said other users reported losses of about $200,000 and unexpected withdrawal-signature requests on the official site.

Polymarket confirmed the breach in a post from its Polymarket Traders account. It said it had fixed the issue, that a third-party provider had been compromised, and that the matter had been referred to law enforcement. “Anyone who has been impacted will be made whole,” the company wrote.

Polymarket did not name the provider or explain how refunds would be paid. Its statement covered only the international platform; Polymarket’s US exchange operates as a separate venue regulated by the Commodity Futures Trading Commission (CFTC).

How the Malicious DebugBear Script Worked

Researchers at Hudson Rock traced the theft to a JavaScript file served from DebugBear, a web performance monitoring company that has since confirmed a security incident, according to the firm’s analysis. Websites load DebugBear’s real-user monitoring (RUM) script to measure page speed. The 15,187-byte file Hudson Rock retrieved did something else: it read three browser storage entries holding a user’s Polymarket login parameters, proxy wallet address, and trading API keys. It then searched the running web app for the user’s live trading client and signer.

The code handled two account types differently, Hudson Rock found. For accounts connected through a user’s own wallet, it built a batch transfer that sent the user’s position tokens straight to the attacker. For accounts created through Magic, Polymarket’s email-login wallet service, it placed sell orders at progressively lower prices, then tried to move the proceeds out. It also sent each victim’s wallet address, IP location, and portfolio value back to DebugBear’s data endpoints.

Polymarket’s live site code supports this account. Hudson Rock found production build metadata with the commit message “chore(polymarket): remove debugbear rum script”, time-stamped 17:59:20 UTC. That was six minutes before the exchange entered cancel-only mode. Polymarket’s smart contracts were never touched: the script used trading permissions that victims’ own browsers already held.

DebugBear confirmed on X that it had been “impacted by an ongoing security incident.” It told every customer of its RUM product to remove the DebugBear embed code from their websites. The company has not said how its systems were breached, when the incident began, or whether any customer other than Polymarket was served the malicious code.

Hudson Rock said it has not established how the script was compromised, how long it was served, or how many users it reached. Its analysis also found no evidence of other DebugBear customers being affected, though DebugBear’s warning means any site still loading the RUM snippet is running code from a provider that has not yet contained the breach.

The money trail points to a single address. Blockchain analytics firm Arkham’s data shows the suspected attacker wallet, 0x3F99…Ffc18, holding about $2.65 million in POL, Polygon’s native token, Decrypt reported. The funds arrived through several swaps from USDC.e, a bridged version of the USDC stablecoin. Hudson Rock said the same address is hard-coded in the script as its default recipient. That balance is not a confirmed total for the theft, however, because the script could also pull a different recipient from a remote configuration file.

Polymarket’s Third Third-Party Breach in Ten Months

This is Polymarket’s third incident involving an outside provider since December 2025. That month, the company blamed a vulnerability at a third-party authentication provider for drained accounts; users suspected Magic Labs, though Polymarket never named the company.

In May 2026, a leaked private key emptied an internal top-up wallet of about $700,000. On 25 June, a compromised vendor injected a wallet-draining script into Polymarket’s site and stole about $3 million from fewer than 15 accounts. Polymarket refunded those users in full and did not name that vendor either.

Anyone who used Polymarket.com on 29 October should reject any unexpected signing or approval requests and close browser tabs left open from that day. They should also check their order history and wallet activity through a fresh session or PolygonScan.

Hudson Rock also advises reviewing active sessions and API credentials. Affected users should save transaction hashes for the compensation process and ignore unsolicited “recovery” messages, which often follow incidents like this.

Several questions remain unanswered: how the attacker gained control of the DebugBear-hosted file, how long it was live on Polymarket.com, how many accounts it drained, and when refunds will arrive.