Polymarket Traders Lost Over $2 Million After Hackers Poisoned a Website Monitoring Script It Trusted

Polymarket users started reporting withdrawals they had not made on Thursday, and the prediction market halted trading on its international platform. The culprit was not a flaw in the exchange itself. It was malicious JavaScript served from DebugBear, a UK website performance monitoring firm whose snippet ran on Polymarket's site.

More than $2 million is gone. It is also the second time since June that a third-party script has been turned against Polymarket's frontend.

A status page and a short statement

Outages began around 2pm Eastern. Polymarket's status page switched the exchange to cancel-only mode with relayer actions suspended, and trading resumed about an hour later.

The company's statement was brief: "One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement. Anyone who has been impacted will be made whole." It did not name the vendor or disclose losses, and a spokesperson declined questions. Its US platform was reportedly unaffected.

The name came from Hudson Rock, a security firm. DebugBear then confirmed it had been "impacted by an ongoing security incident," urged customers of its real user monitoring product to pull its snippet from their websites, and brought in incident responders.

No passwords needed

Hudson Rock obtained the malicious code from a DebugBear address used by Polymarket. It hunted for a logged-in user's trading tools and portfolio. Depending on the account type, it then tried to sell positions and move the proceeds, or send position tokens straight to an address set by the attacker.

The firm did not find a routine that sends passwords, seed phrases or private keys out. "Its central approach is to reuse authority already available in the authenticated application," it said. In other words, the script did not need to steal a trader's keys when it could act as the trader.

A Polymarket production build timestamped 17:59 UTC carried a change note about removing the DebugBear script.

Three counts, no final tally

Nobody has a settled number. Hudson Rock saw about $2.19 million at the script's hard-coded fallback address, which it does not present as a verified total. GoPlus puts losses at roughly $2.71 million, with the attack path running through 710 deposit wallets and 731 addresses, though the address count is not a count of victims. Arkham showed a suspected attacker wallet, the same address hardcoded in the script, holding about $2.65 million.

Other questions are wider open: how the script was tampered with, how many users were hit and who did it. Hudson Rock found no sign that other DebugBear customers were targeted.

The second time in four months

In June, Polymarket disclosed another third-party compromise that injected a malicious script into its frontend, with losses around $3 million. Same type of weakness, different supplier, and this time a tool whose whole job was to keep an eye on the website.

On the same day, attackers took around $6.3 billion from Binance, in a theft blockchain analysts blame on North Korea. Nobody has been named for the Polymarket attack.

Polymarket was banned in the US until 2025 and remains banned in several countries, including France and Brazil. It has pledged to fully reimburse affected traders.

Some offers on this page may be paid placements or contain affiliate links.