A Polymarket security breach drained an estimated $2.5 million from customer accounts on Thursday after hackers compromised a British web monitoring supplier. The prediction market suspended international transactions for an hour while engineers stripped malicious code from the platform, later pledging that all affected users would receive full refunds.
Key points
- Attackers injected malicious wallet-draining JavaScript into an external performance-monitoring script run by British vendor DebugBear.
- The code intercepted authenticated sessions on Polymarket’s international exchange to sell positions and transfer tokens without user consent.
- On-chain data traced roughly $2.5 million in tokens to a central attacker wallet before the platform halted operations.
- Polymarket restored full trading after removing the supplier code and referred the theft to law enforcement in the United Kingdom.
How the attack unfolded
Traders using Polymarket’s international platform first noticed unauthorised withdrawals and unexpected order liquidations early on Thursday afternoon. Shortly before 2:00 p.m. Eastern Time, users began sharing screenshots of emptied balances and automated token sales executed from their profiles.
Polymarket moved quickly to contain the losses. At 2:05 p.m. ET, the platform placed its core exchange into cancel-only mode and suspended relayer actions to prevent further asset transfers. The company announced on social media that it had paused operations out of caution while engineers investigated an incident involving an external supplier.
Thirty-two minutes later, Polymarket stated that it had identified and resolved the core issue. By 3:05 p.m. ET, the company reopened trading across its international order book. Polymarket confirmed that its domestic American exchange, Polymarket US, remained entirely unaffected by the incident because it operates on separate technical and legal infrastructure.
“One of our third party providers was compromised, and we have referred this to relevant law enforcement,” the company said in a public statement. Polymarket added that all traders who lost funds during the disruption would be reimbursed in full, though it did not specify a timeline for payouts.
Malicious script targeted user sessions
The intrusion did not stem from a direct compromise of Polymarket’s core smart contracts or internal servers. Instead, attackers targeted DebugBear, a website monitoring firm based in the United Kingdom that provides real user monitoring tools to help companies track web performance and browser loading speeds.
DebugBear confirmed that it had suffered an intrusion and advised all clients to strip its monitoring script from their websites immediately. Shortly afterwards, DebugBear’s own public website went offline, returning network error messages as technical teams attempted to contain the damage.
Security researchers at Hudson Rock discovered that Polymarket’s production build metadata recorded an emergency update at 1:59 p.m. ET with the commit message “chore(polymarket): remove debugbear rum script”. That change eliminated the vendor’s hosted JavaScript file from the exchange’s client-facing code base.
Technical analysis revealed how the intrusion functioned inside victim browsers. A VirusTotal file analysis of the modified script showed that the payload was engineered specifically to exploit authenticated Polymarket sessions. When a logged-in user opened the site, the script queried their active balances and prediction market holdings.
Depending on how the trader had authenticated, the script executed automated commands through Polymarket’s native transaction functions. For some accounts, the script triggered rapid liquidation of prediction shares at market rates. For others, it transferred outcome tokens and underlying stablecoins directly to external wallets while relaying account status updates back to DebugBear infrastructure.
Tracing the stolen funds
Blockchain investigators moved quickly to map the flow of capital as the exploit unfolded. Public ledger records showed heavy, automated transaction volume striking Polymarket’s contracts between 1:50 p.m. and 1:56 p.m. ET, just minutes before administrators intervened.
Analysts isolated a primary destination address embedded within the malicious script. The Polygonscan transaction logs recorded roughly 28.6 million POL, worth approximately $2.57 million, moving through the suspected attacker wallet before being dispersed across three secondary addresses.
Blockchain analytics firm Bubblemaps estimated that roughly 700 individual user wallets suffered unauthorised withdrawals during the six-minute attack window, putting total losses near $2.7 million. At the same time, Arkham intelligence data showed that the core exploit address received approximately $2.65 million in mixed digital tokens before the drain halted.
Polymarket declined to share internal figures regarding the precise number of impacted accounts or the exact sum of money drained. The platform reiterated that its balance sheet would cover all verified trader balances lost to the malicious script.
Repeated security challenges
The breach marks another operational hurdle for Polymarket, which has expanded rapidly over the past two years amid surging retail interest in event contracts. In June 2026, an unrelated security lapse resulted in more than $2 million in losses for platform participants.
Beyond credential theft and script injections, the exchange has faced repeated attempts by traders to manipulate contract settlements. Earlier disputes included an effort by an oracle token holder to alter the resolution of a market tied to Ukrainian mineral assets, alongside contract anomalies that produced a $520,000 exploit earlier in the platform’s history.
The company has also operated under intense scrutiny regarding market integrity. Federal authorities have brought insider trading charges in separate cases involving a special forces soldier accused of wagering on geopolitical operations and a former Google worker accused of trading on confidential corporate disclosures. Both individuals have pleaded not guilty.
Despite those controversies, capital has poured into the business. Polymarket closed a $1 billion funding round in August 2026 led by 1789 Capital, lifting the company’s valuation to $21 billion. That scale has made its web infrastructure an increasingly lucrative target for sophisticated supply-chain attacks.
What happens next
The swift containment of Thursday’s incident limited the drain to a narrow group of active browsers, but it highlighted the vulnerability of web-based cryptocurrency platforms to third-party software compromises. By inserting malicious instructions into an otherwise routine analytics tag, attackers bypassed the need to break into Polymarket’s underlying smart contracts or private keys.
UK police authorities are reviewing the compromise of DebugBear’s infrastructure, while Polymarket engineers continue auditing third-party scripts across the international portal. The exchange has instructed traders who detected unauthorised balance drops to submit account details to customer support for reimbursement verification.
