Polymarket Hack Exposes Over 700 User Accounts

Polymarket suspended its trades for about an hour after the diversion of at least $2.6 million belonging to its users. The attack did not target the blockchain itself, but a performance measurement tool integrated into the site, revealing a often overlooked weakness of non-custodial platforms.

A Simple Tracking Script Opened Access to Accounts

The incident began on October 29 on the international platform Polymarket.com. Users reported unauthorized sales of their positions and transfers of their assets. One claimed to have lost $800,000, while another account was reportedly emptied of $600,000.

Polymarket initially switched its market to “cancel-only” mode. Traders could cancel their existing orders but could no longer place new ones. Actions of the service responsible for sending signed transactions to the blockchain were also suspended.

The available information allows reconstruction of the main stages of the incident :

• A third-party solution integrated into the site was compromised ;
• A malicious JavaScript code targeted already connected sessions ;
• Some users’ positions were sold without their consent ;
• The obtained assets were then sent to an address controlled by the attacker ;
• More than 700 accounts were affected, for at least $2.6 million ;
• Polymarket promises to fully reimburse the victims.

The interruption lasted one hour. The platform then announced it had fixed the problem and restored all its services. It assured, while specifying it had transmitted the case to the British authorities:

Anyone affected will be fully compensated.

The final amount has not yet been communicated, however. Estimates mainly rely on the movements observed towards an address attributed to the attacker. The exact number of victims and reimbursement terms also remain to be determined.

The Blockchain Was Intact, But Polymarket’s Interface Was Not

The first on-chain analyses point to DebugBear, a British company specialized in monitoring website performance. Its Real User Monitoring service relies on a script integrated into its clients’ pages to measure loading times and visitor experience.

After this infrastructure was compromised, the legitimate script was reportedly replaced or modified to integrate malicious code. This code checked if the visitor was logged into Polymarket, then attempted to use their active session to sell their positions and transfer their assets.

Researchers from Hudson Rock identified in this code an address serving as a recipient of the funds. Blockchain analysis shows that 28.6 million POL tokens, valued at about $2.57 million, were then distributed among several wallets.

DebugBear has acknowledged facing an “ongoing security incident” and asked its clients to remove its embedded code. This detail is crucial. The attacker did not break Polygon, forged an on-chain transaction, nor compromised the core smart contract of the prediction market. They hijacked the web layer used to prepare and authorize operations.

A platform can thus remain technically non-custodial while exposing its users through its interface. When the browser loads an external component, this provider indirectly inherits a position of trust. If compromised, the code displayed can be more dangerous than a flaw in the protocol itself.

Two Similar Attacks Expose a Structural Risk

The episode is all the more worrying since it is not an isolated case. In June, the compromise of another provider had already allowed malicious code injection into Polymarket’s interface. About $3 million was then stolen from fewer than fifteen accounts.

Combining the two incidents, nearly $5.6 million would have been diverted in a few months through third-party providers. The repetition shifts the debate: the problem is no longer just a failing provider, but how Polymarket controls scripts executed on its site.

The reimbursement promise limits the direct financial loss for traders, without eliminating operational risk. A position sold during a volatile market cannot always be rebuilt identically. Compensation will therefore have to determine if it covers only the funds diverted or also the value of positions closed against users’ wishes.

The incident finally reminds us that a personal wallet does not protect against all scenarios. An active session, a still valid authorization, or a signature obtained via a compromised interface can suffice. For Polymarket, the real task now is to reduce external dependencies and prevent a secondary tool from again commanding financial operations.