Polymarket Halts Trading After Third-Party Compromise Enables Crypto-Draining Script

Prediction market platform Polymarket suspended trading on Thursday after hackers compromised a third-party service to distribute cryptocurrency-draining JavaScript, with approximately $2.5 million in assets traced to a suspected attacker wallet. The company confirmed the security incident, saying it had identified and fixed the issue affecting its international platform, Polymarket.com, and had referred the breach to law enforcement. "One of our third party providers was compromised, and we have referred this to relevant law enforcement," Polymarket said. "Anyone who has been impacted will be made whole. Out of an abundance of caution, we have temporarily halted trading and are working to bring the platform back online." According to the company's timeline, Polymarket placed its exchange into cancel-only mode at 2:05 p.m. ET and paused relayer actions while investigating. At 2:37 p.m., the company announced the issue had been fixed and that trading was being temporarily halted as a precaution. Trading resumed roughly one hour after the initial suspension, with the incident marked resolved at 3:05 p.m. ET. "Trading is now fully back online," the company announced on X. "We'll make this right and are fully reimbursing all affected traders." Polymarket has not disclosed how many users were affected, how much cryptocurrency was stolen, or how the reimbursement process will work. Security researchers at Hudson Rock identified a suspected attacker-controlled wallet, 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18, embedded in the malicious JavaScript. An examination of the wallet's blockchain activity found it transferred approximately 28.6 million POL, valued at roughly $2.57 million, to three additional wallets. Blockchain records also show the wallet conducted numerous transactions involving Polymarket's prediction-market token contract between 1:50 p.m. and 1:56 p.m. ET, shortly before the exchange suspended trading. Hudson Rock reported the wallet held approximately $2.19 million in cryptocurrency at the time of its investigation. The malicious script was distributed through cdn.debugbear[.]com/C7xcKKrjUnXK.js and was hosted on infrastructure belonging to DebugBear, a website performance-monitoring service that helps organizations track loading speeds and user experience. DebugBear's Real User Monitoring product uses JavaScript embedded in websites to collect performance metrics from visitors' browsers. The company has since confirmed it is investigating an ongoing security incident and warned customers to remove its monitoring JavaScript from their websites. "We're impacted by an ongoing security incident," DebugBear said in a post on X. "If you use our RUM product, please remove the embed code from your website." At the time of writing, DebugBear's website was inaccessible, displaying a Cloudflare error, though it is unclear whether the outage relates to containment efforts or another consequence of the incident. Hudson Rock's researchers also discovered Polymarket production build metadata containing the commit message "chore(polymarket): remove debugbear rum script (#15337)," indicating the platform had removed the DebugBear monitoring integration. The build was timestamped October 29 at 1:59 p.m. ET, shortly before Polymarket publicly announced the incident. An analysis of the malicious script found it was designed to hijack authenticated Polymarket trading sessions, liquidate users' prediction-market positions, and transfer cryptocurrency and other assets to an attacker-controlled wallet. The malware checks whether a visitor is logged into Polymarket and attempts to use their existing trading session and the platform's own trading functionality to carry out unauthorized transactions. It then examines the user's cryptocurrency balances and prediction-market positions to determine the value of their holdings. Depending on how the user authenticated, the malware either attempts to automatically sell their prediction-market positions or transfer their prediction-market tokens directly to the attacker wallet. It also attempts to convert cryptocurrency holdings into transferable assets using Polymarket's existing transaction functionality. The script additionally communicated with data.debugbear.com to receive instructions and send data about targeted accounts, wallet addresses, balances, and transaction results. The use of DebugBear's infrastructure both to distribute the malicious script and to serve as a command-and-control and data exfiltration server raises questions about how much access the attackers had to the company's systems. Both Polymarket and DebugBear have been contacted with questions about the incident.