Polymarket Hack Drains $2.7M From 700 Users as Third-Party Breach Forces Trading Halt

A third-party breach drained $2.7 million from 737 Polymarket accounts, forcing a trading halt. The platform pledged full reimbursements. | Credit: CCN.com

Key Takeaways

Hackers drained approximately $2.73 million from 737 Polymarket accounts through 985 withdrawals in about an hour.
Malicious code linked to a third-party monitoring script exploited logged-in sessions to sell positions and transfer assets.
Polymarket temporarily restricted trading, restored operations, and promised full reimbursements.

Hackers stole approximately $2.7 million from more than 700 Polymarket accounts on Oct. 29 after malicious code in a third-party website tool exploited active trading sessions, forcing the prediction market to temporarily halt trading.

Polymarket confirmed that an outside provider had been compromised, said it had resolved the issue, and pledged to reimburse affected users. Trading subsequently resumed on its international platform.

Blockchain analytics firm Bitquery traced approximately $2.73 million in unauthorized withdrawals across 737 accounts.

The incident highlights how compromised website software can expose traders even without an identified vulnerability in the underlying smart contracts.

Compromised Monitoring Script Targeted Logged-In Traders

Security researchers linked the attack to a JavaScript file served through infrastructure belonging to DebugBear, a website performance-monitoring provider.

Hudson Rock researchers independently downloaded the suspicious file twice and found identical malicious code. Instead of measuring website performance, the script searched for logged-in Polymarket sessions, inspected portfolios, and attempted to sell positions or transfer assets.

The code accessed account information stored in the browser and searched the application for its existing trading client and transaction signer. That gave it a route to exploit permissions already available within an authenticated session.

Hudson Rock found no separate routine in the examined sample that transmitted passwords, seed phrases, or private keys to the attacker. Its central finding concerned the misuse of an active session’s authority.

Researchers also identified production-build metadata recording the removal of DebugBear’s monitoring script at 17:59 UTC. However, they cautioned that removing the integration did not establish the precise exposure window or prove every existing browser session was safe.

The initial method used to compromise the provider remains unresolved. Polymarket’s public confirmation identified a third-party breach without naming the vendor.

Investigators Trace 985 Withdrawals in One Hour

Bitquery’s investigation placed the main withdrawal activity between 17:10 and 18:10 UTC, when attackers executed 985 operations through Polymarket’s existing infrastructure.

The transactions carried valid authorizations, allowing smart contracts to process them as legitimate actions despite the account owners’ lack of consent.

Losses varied sharply. Four accounts accounted for approximately 43% of the stolen amount, while the largest single withdrawal totaled $358,369. Another 276 accounts lost less than $100 each.

The attackers also seized prediction-market shares from 33 users. Bitquery did not assign a dollar value to those positions, so the reported withdrawal total may not capture the full economic damage.

Investigators traced stolen assets into POL, Polygon’s native token, before funds spread across additional wallets. Some assets subsequently moved to Ethereum via Relay, deBridge, and Polygon’s native bridge.

These movements complicate recovery by distributing proceeds across addresses and networks. They also distinguish the amount initially stolen from balances visible in any single attacker-controlled wallet.

Trading Resumes as Reimbursement Questions Remain

Polymarket switched its international exchange to cancel-only mode at approximately 18:05 UTC, blocking new trading activity while allowing users to cancel existing orders. It also suspended transaction submissions through its relayer infrastructure.

The company later said it had identified and fixed the problem. Investigations placed the trading restoration at approximately 19:05 UTC, although some reports indicated a later restart time.

Polymarket promised full compensation and referred the incident to law enforcement. Reuters reporting identified UK authorities as involved.

Bitquery nevertheless flagged another suspicious withdrawal of $10.99 at 19:11 UTC from an already-affected account, using a new authorization. That transaction does not establish that the wider attack continued, but it warrants examination.

The breach follows a reported third-party attack in June that caused approximately $3 million in losses. A final accounting, reimbursement timetable, and complete explanation of containment would help users assess whether Polymarket has addressed the recurring exposure.