Polymarket suspends trading after $2.7 million breach via third-party software

Hackers siphoned an estimated $2.7 million from hundreds of Polymarket accounts on Thursday, October 29, after compromising software supplied by a third-party provider, prompting the prediction market operator to suspend trading temporarily and promise reimbursements.

Breach details

Security researchers found that attackers had tampered with JavaScript code embedded in Polymarket’s website, allowing malicious instructions to run when traders visited the legitimate site. The breach involved DebugBear, a UK-based provider of website performance-monitoring software.

Blockchain analytics firm Bubblemaps estimated that around 700 users were affected by the attack on Polymarket’s international platform. BleepingComputer traced transactions involving approximately $2.57 million in Polygon’s POL cryptocurrency from a suspected attacker wallet to three other addresses.

The incident affected Polymarket.com, its cryptocurrency-based international exchange, not Polymarket US, which operates separately under US financial regulation.

Trading suspension and response

Polymarket placed its exchange into cancel-only mode at 2:05 p.m. Eastern on Thursday, preventing new trades while allowing existing orders to be cancelled. It resumed normal trading around 3:05 p.m. Polymarket restricted trading for approximately an hour while investigating the breach, before restoring normal operations.

DebugBear acknowledged an ongoing security incident and urged customers using its Real User Monitoring product to remove the software’s embedded code from their websites.

Reimbursement process

According to CNBC, Polymarket told users on Discord that those who lost less than $10,000 would have their funds restored by Friday, October 30. The company told traders who lost more than $10,000 that they would need to sign release agreements before receiving reimbursement.

In June, another third-party breach resulted in approximately $3 million being stolen from Polymarket users, according to CoinDesk.