Polymarket Users Drained by Malicious Script Hidden Inside a Website Analytics Tool
Read Time:3 Minute, 38 Second
Trading Halted After Reports of Vanishing FundsPrediction market platform Polymarket temp
Altro...
Read Time:3 Minute, 38 Second
Trading Halted After Reports of Vanishing FundsPrediction market platform Polymarket temp
Altro...Read Time:3 Minute, 38 Second
Trading Halted After Reports of Vanishing FundsPrediction market platform Polymarket temporarily suspended trading on October 29, 2026, after a wave of users reported funds missing from their wallets, unauthorized withdrawals, and open positions being closed without their consent. The company confirmed a security incident, said it had identified and fixed the underlying issue, and promised to reimburse affected traders before resuming trading shortly afterward.
In its public statement, Polymarket said the root cause traced back to a compromised third-party provider and that the matter had been referred to law enforcement, though it stopped short of naming the vendor involved. Subsequent reporting has connected the incident to DebugBear, a website performance-monitoring service, though Polymarket’s own statement did not confirm this directly.
Not Malware — A Script Riding Along on a Trusted ToolWhat makes this incident notable is how the theft was actually carried out. Security researchers at Hudson Rock say they found malicious JavaScript being served from a DebugBear-linked address associated with Polymarket’s site. Rather than simply measuring how fast pages loaded, as a performance-monitoring tool normally would, the script was quietly scanning the page for signs of an active trading session, pulling account details, and attempting to reuse the platform’s own trading functionality to move assets — all from inside a tab the user had already legitimately opened and logged into.
Specifically, the script reportedly read data sitting in the browser’s local storage, including account information, a wallet address, and trading API credentials, then searched through the page’s React application code to locate a live trading client and the signer component responsible for authorizing wallet actions. Rather than phishing for a password, the attack leveraged access that was already unlocked inside an open session — a technique that sidesteps many of the defenses built around login forms and credential theft.
Researchers observed the script attempting different tactics depending on the type of account it found: in some cases trying to transfer position tokens directly, in others attempting to sell open positions first and then move the resulting funds. The code was also seen requesting signatures and submitting transactions through Polymarket’s own relayer infrastructure. Hudson Rock noted it did not actually execute the malicious sample during testing, so its findings describe the script’s intended behavior rather than definitive proof every attempted transfer went through successfully.
Early Loss Estimates Remain UnofficialOutside analysis cited by financial media has linked at least $2.7 million in suspicious withdrawals to roughly 710 separate wallets, though that figure comes from independent trackers rather than an official Polymarket disclosure, and the company has not published a confirmed total loss. Reporting also indicates that Polymarket’s separate U.S.-facing platform was not affected, with the compromise limited to the international product.
On reimbursement, Polymarket has said affected users will be made whole, with smaller claims — reportedly those under $10,000 — restored quickly, while larger claims require submitting a formal release form before funds are returned. What remains unresolved publicly is the precise window during which the malicious script was live and exactly how the third-party provider itself was first compromised.
A Reminder That Trusted Third-Party Code Is an Attack SurfaceThis is not an isolated pattern. Security researchers have previously documented similar supply-chain-style attacks where legitimate, trusted scripts running on sensitive pages were quietly repurposed to steal cryptocurrency, including a prior case involving a compromised ad-tech script and a separate incident involving a tampered JavaScript package used in XRP wallet software. Each case used a different delivery method, but all shared the same underlying weakness: a trusted third-party script with broad access to the page it runs on.
For traders on any platform that integrates outside analytics, chat widgets, or monitoring tools, researchers recommend a few concrete precautions:
Close browser tabs with active trading sessions when they are not actively in use.
Review recent orders and wallet transactions directly through official platform channels, not links sent by email or social media.
Reject any unexpected wallet signing requests, even ones that appear to originate from a familiar app.
Never share a seed phrase, and treat unsolicited “recovery” links with suspicion.
Disconnecting a wallet after the fact does not undo transfers that already completed or revoke blockchain approvals granted earlier, so the most effective defense remains catching suspicious activity before a signature is approved — not after.
