01.04.2025
2 min
760
Prediction market platform Polymarket temporarily suspended trading following a cyberattack in which attackers distributed malicious JavaScript through a third-party service. Researchers identified a cryptocurrency wallet linked to the attack through which approximately $2.5 million in assets had passed.
On October 29, 2026, Polymarket confirmed a security incident involving the compromise of one of its third-party service providers. The company said it had identified and resolved the issue affecting its international platform, Polymarket.com, and reported the attack to law enforcement authorities.
“One of our third-party providers’ systems was compromised, and we have reported the incident to the appropriate law enforcement authorities. All affected users will be compensated. As a precaution, we have temporarily suspended trading and are working to restore the platform,” Polymarket stated.
At 2:05 p.m. Eastern Time (ET), the exchange was placed in cancel-only mode, allowing users to cancel previously placed orders but preventing new trades. Relayer operations were also suspended while the incident was investigated. At 2:37 p.m., the company announced that the issue had been resolved, although trading remained suspended as a precaution. Full trading functionality was restored approximately an hour after the initial suspension, and the incident was officially marked as resolved at 3:05 p.m. ET.
“Trading is fully back online. We will make things right and fully reimburse all affected traders,” the company announced on X.
However, Polymarket did not disclose how many users were affected, the total amount of cryptocurrency stolen, or how the compensation process would work.
Security researchers at Hudson Rock identified a cryptocurrency wallet embedded in the malicious JavaScript code that was allegedly controlled by the attackers. Blockchain analysis conducted by BleepingComputer revealed that approximately 28.6 million POL tokens, worth around $2.57 million, had been transferred from this wallet to three other wallets. Between 1:50 p.m. and 1:56 p.m. ET, shortly before trading was suspended, the wallet also carried out numerous transactions involving Polymarket prediction market tokens. According to Hudson Rock, the wallet held approximately $2.19 million in cryptocurrency assets at the time of the investigation.
Hudson Rock researchers discovered that the malicious code was distributed through the file cdn.debugbear[.]com/C7xcKKrjUnXK.js, hosted on DebugBear’s infrastructure. DebugBear is a service that helps website owners monitor page loading speeds and user experience. One of its tools, Real User Monitoring (RUM), uses JavaScript embedded in web pages to collect performance metrics directly from visitors’ browsers.
DebugBear confirmed that it was investigating a security incident and urged customers to temporarily remove the monitoring script from their websites.
“We are experiencing an ongoing security incident. If you are using our RUM product, please remove the embed code from your website,” DebugBear representatives stated on X.
At the time of reporting, DebugBear’s website was inaccessible and displayed a Cloudflare error. It remained unclear whether the outage was related to efforts to contain the attack. Meanwhile, Hudson Rock discovered metadata from a Polymarket production build containing the commit message chore(polymarket): remove debugbear rum script (#15337), indicating that the platform had removed its DebugBear integration. The build was created on October 29 at 1:59 p.m. ET, shortly before Polymarket publicly disclosed the incident.
BleepingComputer’s analysis of the malicious JavaScript file on VirusTotal revealed that the code was designed to hijack active Polymarket trading sessions, liquidate users’ prediction market positions, and transfer cryptocurrency and other assets to an attacker-controlled wallet.
Once loaded, the script checked whether a visitor was logged into the platform and attempted to exploit their active session to execute unauthorized transactions. It then examined the user’s cryptocurrency balances and open positions to determine the value of their available assets. The theft method depended on how the user had authenticated: in some cases, the malicious code attempted to automatically sell their positions, while in others, it tried to transfer prediction market tokens directly to the attacker’s wallet.
In addition, the malware used Polymarket’s built-in functionality to convert cryptocurrency assets into funds that could be transferred to attacker-controlled wallets. This allowed the attackers to target not only users’ wallet balances but also assets held in their open trading positions.
Further analysis revealed that the malicious script communicated with the data.debugbear.com domain to receive instructions and transmit information about targeted accounts, cryptocurrency wallet addresses, user balances, and transaction results.
DebugBear’s infrastructure was effectively used to distribute the malicious code, operate a Command and Control (C2) server, and exfiltrate collected data. This raised further questions about how extensively the attackers had gained access to the service’s systems. The full scope of the compromise remains unknown.
Polymarket has since resumed trading and promised to compensate affected traders for their losses. However, the company has yet to confirm the total number of compromised accounts or the final amount of cryptocurrency stolen.
