Polymarket, a prediction market platform, fell victim to a security breach on October 29, 2026, when a compromised third-party service exposed its international users to wallet theft. A malicious script injected through this vendor resulted in funds being stolen, positions closed without consent, and unexpected transactions executed in active accounts. Polymarket temporarily halted trading, later said the issue was resolved, and committed to reimbursing those impacted before resuming operations.
What Went Wrong: The Technical Breakdown
Investigative findings reveal that the attacker used a vendor–supply-chain route involving DebugBear, a website performance monitoring service tied to Polymarket. Though the company has not formally confirmed the name, early reporting points to this being the source of the vulnerability. In practice, JavaScript delivered from a DebugBear address didn’t just collect performance data—it searched for live trading sessions, read browser storage to extract account info, wallet addresses, and API credentials, then leveraged the site’s existing trading tools to transfer assets without needing a stolen password.
The script’s behavior depended on the user’s account type: in some cases, it moved position-tokens directly; in others, it first sold open positions and then transferred remaining funds. It even requested the user’s cryptographic signatures through Polymarket’s transaction relayer. While researchers couldn’t verify whether every malicious transfer succeeded, they did obtain identical copies of the malicious code and documented its full intended behavior.
Scale of the Attack & Company Response
Analysis from firms Betting Intelligence and Polysights estimates losses at around $2.7 million across 710 wallets. That figure remains preliminary and is not an official total. The attack seems limited to Polymarket’s international platform; its U.S. service reportedly was not compromised.
Polymarket has pledged to make users whole. Those who lost under $10,000 should expect full reimbursement by October 30. For larger losses, claimants must complete a release form. While financial compensation is underway, key questions remain about how the breach began and how long user funds were exposed.
User Remediation & Broader Lessons
Experts recommend that impacted users close browser tabs related to the trading platform, review recent wallet transactions via trusted tools, and retain transaction hashes for any support requests. It’s critical to reject unexpected signing requests, avoid clicking unverified recovery links, and never share seed phrases. Disconnecting a wallet won’t undo transfers or revoke blockchain approvals once executed.
This incident underscores the risks posed when third-party scripts are able to operate on sensitive pages—trusted infrastructure can become a backdoor for theft. It’s a reminder that supply-chain vulnerabilities remain among the most dangerous threats in crypto ecosystems, where external code can run with high privileges.
What this means: Even established platforms are only as secure as their weakest external dependency. As protocols and players like Polymarket continue to evolve, scrutiny over vendor safety and third-party script control will be paramount. Regulators, users, and developers alike should press for transparency around exposure windows and hold platforms accountable not just for internal security, but for the risks introduced through their supply chains.
