Polymarket Breach: $2.57M Traced As Platform Restores Trading
BleepingComputer traced roughly $2.57M in transfers from a suspected attacker wallet; Polymarket reopened trading and pledged refunds.
Polymarket’s third-party security breach has been linked to transfers worth roughly $2.57M from a suspected attacker wallet, according to BleepingComputer’s investigation. The prediction-market platform restored international trading on 29th October and pledged to reimburse affected customers.
That figure measures transfers from the wallet to three other addresses, rather than Polymarket’s final confirmed loss. The malicious script examined by Hudson Rock contained the suspected wallet’s address. BleepingComputer traced its subsequent transfers; the platform had not disclosed a final theft total in the outlet’s report.
The company said it had fixed the issue and referred the incident to UK law enforcement, according to Reuters. A person familiar with the matter identified the provider as DebugBear, which supplies website performance monitoring tools.
DebugBear separately acknowledged a security incident and urged customers to remove its Real User Monitoring code, Reuters reported. Its Real User Monitoring product, known as RUM, embeds code in websites to collect performance measurements from visitors' browsers. Those measurements help website operators monitor loading speeds and user experience.
Polymarket placed the platform in cancel-only mode at 18:05 UTC and marked the incident resolved at 19:05 UTC on 29th October, BleepingComputer reported. It also paused relayer actions, which submit transactions on users' behalf.
Hudson Rock's technical investigation examined a script retrieved from DebugBear infrastructure. It searched the application for an existing trading client and signer, the component used to authorise transactions, then inspected the signed-in user's balances and positions.
The code followed different paths depending on the account type. One attempted to transfer position tokens directly to a configured recipient. Another attempted to sell positions and move the proceeds. It also checked for location restrictions and stopped if Polymarket marked the visitor as blocked. Hudson Rock did not execute the sample against a connected wallet, and its analysis does not establish that every attempted action completed.
BleepingComputer separately examined the malicious code and described attempts to hijack authenticated trading sessions. Code added to measure website performance was able to seek the trading functions already available inside the page.
Hudson Rock also found production-build metadata recording removal of the DebugBear integration. Its later homepage capture lacked the suspect reference. Those observations support removal from the build it examined, without establishing the full exposure period or the state of every browser session.
The company statements reported by Reuters committed to full reimbursement. BleepingComputer reported that Polymarket had not disclosed the number of affected users, the final amount stolen or the refund process.
