Prediction market platform Polymarket temporarily suspended trading on Thursday, October 29, after attackers compromised a third-party JavaScript provider and used malicious code to target users’ cryptocurrency and prediction market assets. Blockchain activity linked to an alleged attacker-controlled wallet indicates that approximately $2.5 million in assets may have been involved.
Polymarket said it identified and fixed the issue affecting its international platform, Polymarket.com, and reported the incident to law enforcement.
“One of our third-party providers was compromised and we have reported this to the relevant law enforcement authorities,” Polymarket said.
“Anyone affected will recover. Out of an abundance of caution, we have temporarily suspended trading and are working to bring the platform back online.”
Polymarket initially placed the exchange in cancellation-only mode at 2:05 p.m. ET and suspended relayer actions while it investigated. At 2:37 p.m. ET, the company said the issue had been resolved and that trading had been suspended as a precaution.
Trading resumed about an hour after the initial suspension, and Polymarket said the incident was resolved at 3:05 p.m. ET.
“Trading is fully back online,” the company said on X. “We will make this right and provide full refunds to all affected traders.”
Polymarket did not disclose how many users were affected, how much cryptocurrency was stolen, or how the refund process would work.
Security researchers at Hudson Rock identified a wallet that appears to be controlled by an attacker. The address, 0x3F99139F1C5854bb628c2e576Aaf638e99dFFc18, was embedded in malicious JavaScript.
BleepingComputer examined the wallet’s blockchain activity and found that approximately 28.6 million POL, equivalent to about $2.57 million, had been transferred to three additional wallets.
Blockchain records show that the wallet conducted multiple transactions involving Polymarket’s prediction market token contract between 1:50 p.m. and 1:56 p.m. ET, shortly before the exchange suspended trading.
Hudson Rock reported that the wallet held approximately $2.19 million in virtual currency at the time of its investigation.
Malicious JavaScript targeted Polymarket users
Hudson Rock security researchers identified malicious JavaScript distributed through cdn.debugbear[.]com/C7xcKKrjUnXK.js. The code was designed to steal cryptocurrency and prediction market holdings from Polymarket users.
The script was hosted on infrastructure belonging to DebugBear, a website performance monitoring service that helps organizations measure page-loading speeds and user experience.
DebugBear’s Real User Monitoring service uses JavaScript embedded in websites to collect performance metrics from visitors’ browsers. The company later acknowledged that it was investigating an ongoing security incident and warned customers to remove its monitoring code from their websites.
“We are affected by an ongoing security incident,” DebugBear said in a post on X.
“If you are using our RUM product, please remove the embed code from your website.”
At the time of writing, DebugBear’s website was unreachable and displayed a Cloudflare error. It was unclear whether the outage was related to containment efforts or another consequence of the incident.
Hudson Rock researchers also found Polymarket production build metadata containing the commit message chore(polymarket): remove debugbear rum script (#15337), indicating that the platform had removed the DebugBear monitoring integration.
The build was timestamped October 29 at 1:59 p.m. ET, shortly before Polymarket publicly disclosed the incident.
Malware attempted to liquidate positions and transfer assets
BleepingComputer analyzed copies of the malicious JavaScript files available through VirusTotal. The code was designed to hijack authenticated Polymarket trading sessions, liquidate users’ prediction market positions, and transfer cryptocurrency and other assets to attacker-controlled wallets.
The malware checked whether a visitor was logged in to Polymarket. If so, it attempted to use the existing trading session and the platform’s trading functions to conduct unauthorized transactions.
It also checked the user’s cryptocurrency balance and prediction market positions to estimate the value of their holdings.
The malware attempted different methods depending on how the user authenticated with Polymarket. In some cases, it tried to automatically sell prediction market positions. In others, it attempted to transfer prediction market tokens directly to an attacker-controlled wallet.
Source: BleepingComputer
The script also attempted to use Polymarket’s existing transaction capabilities to convert users’ cryptocurrency holdings into assets that could be transferred to attacker-controlled wallets.
BleepingComputer found that the malicious code communicated with data.debugbear.com to receive instructions and send information about targeted accounts, wallet addresses, balances, and transaction results.
The use of DebugBear infrastructure to distribute the malicious script and operate as a command-and-control and data-exfiltration server raises questions about how much access the attackers had to the company’s systems.
BleepingComputer contacted Polymarket and DebugBear for more information about the incident and will update the report if either company responds.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com