Polymarket halts trading after compromised third-party provider distributes crypto-draining script

TLDR

• Polymarket halted trading on 29 October after a compromised third-party provider was used to distribute wallet-draining JavaScript.¹
• BleepingComputer says the script was hosted by DebugBear, which told customers to remove its monitoring code from their sites.¹
• Reported wallet figures range from $2.19 million to at least $2.7 million; Polymarket says affected traders will be reimbursed.¹²³

Polymarket temporarily suspended trading on Thursday 29 October after hackers compromised a third-party service to distribute cryptocurrency-draining JavaScript, BleepingComputer reports.¹ Polymarket said: "One of our third party providers was compromised, and we have referred this to relevant law enforcement," adding that anyone impacted would be made whole.¹ It put the exchange into cancel-only mode at 2:05 p.m. ET and said at 2:37 p.m. that the issue had been fixed, with trading resuming about an hour after the initial suspension.¹ Polymarket has not disclosed how many users were affected, how much was stolen or how reimbursement will work, BleepingComputer says.¹ CNBC reports that Polymarket told users on Discord that those who lost less than $10,000 would have funds restored by 30 October, while larger losses require signing a release form, and that the company's US platform was not compromised.³

Polymarket's statements did not name the provider, but BleepingComputer and Hudson Rock both describe the malicious file as served from a DebugBear URL, cdn.debugbear[.]com/C7xcKKrjUnXK.js.¹² DebugBear posted on X that it was "impacted by an ongoing security incident" and asked users of its real user monitoring product to remove the embed code from their websites.¹ CNBC cites a person familiar with the matter as saying the issue stemmed from a hack of DebugBear, and that the matter was referred to UK law enforcement because DebugBear is based there.³ Hudson Rock found Polymarket production build metadata with the commit message "chore(polymarket): remove debugbear rum script (#15337)", timestamped 17:59:20 UTC on 29 October, and describes it as corroborating evidence rather than a formal incident statement.² BleepingComputer gives the same build time as 1:59 p.m. ET.¹

Hudson Rock says the 15,187-byte file reads three local-storage entries holding Polymarket authentication context, searches the page for the live trading client and signer, and then either builds a batch transfer of position tokens to a designated recipient or submits sell orders and tries to move the proceeds.² BleepingComputer's analysis found the script checks whether a visitor is logged in, and that it contacted data.debugbear[.]com for instructions and to send data on targeted accounts, wallet addresses, balances and transaction results.¹ Hudson Rock says its review of the code did not identify a routine that sends a password, seed phrase or private key to the reporting endpoint, and that static analysis does not establish that every code path works.²

The sources give different money figures. Hudson Rock identified the wallet 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18 as hard-coded in the script and reported it held about $2.19 million, which it says is not a verified total of stolen funds.² BleepingComputer says that wallet moved about 28.6 million POL, worth roughly $2.57 million, to three further wallets.¹ The Block reports Arkham data showing a suspected attacker wallet holding about $2.65 million in POL, while CNBC cites analyses by Betting Intelligence and Polysights saying an account withdrew at least $2.7 million across 710 other wallets.⁴³ Hudson Rock says the number of affected users and the initial compromise mechanism remain unresolved.² CNBC adds that Polymarket said in June that a third-party vendor had been compromised and that it would refund affected users.³

Why it matters: a performance-monitoring script loaded on a logged-in trading site was used to attempt asset theft, and the sources do not say how the provider itself was breached.¹²