Key Moments:
- Hackers extracted around $2.7 million from Polymarket user accounts on Thursday (Oct. 29) by exploiting compromised third-party software.
- Trading on Polymarket was halted for about one hour as the breach was investigated, with the operator pledging to reimburse affected users.
- Roughly 700 users were reportedly affected, with losses tracked in Polygon’s POL cryptocurrency by blockchain analytics firms.
Exchange Compromised by Third-Party Software Breach
A major security breach struck Polymarket on Thursday (Oct. 29), as attackers siphoned an estimated $2.7 million from hundreds of accounts. The unauthorized withdrawals stemmed from vulnerabilities in software provided by a third-party vendor, which ultimately led the prediction market operator to halt trading temporarily and commit to making users whole.
Immediate Response and User Impact
Polymarket responded by suspending trading for about an hour during its investigation before restoring the platform’s regular activities. Traders who reported losses above $10,000 were instructed that they would need to sign release agreements prior to receiving reimbursements. The company did not publicly confirm the number of impacted users or exact amount stolen but assured it had resolved the breach and planned to fully compensate affected customers.
| Incident Details | Data |
|---|---|
| Date of Breach | Thursday, Oct. 29 |
| Estimated Amount Stolen | $2,700,000 |
| Estimated Number of Users Affected | 700 |
| Time Trading Was Halted | 2:05 p.m. – 3:05 p.m. Eastern |
Technical Details of the Attack
Security researchers found that malicious modifications were made to JavaScript code housed within Polymarket’s website, specifically via DebugBear, a UK-based web performance monitoring provider. The manipulated script executed on legitimate user sessions, enabling the attackers to gain control without tricking users into clicking phishing links or giving up passwords.
Analysis by Hudson Rock and BleepingComputer revealed this code scanned for active balances and open market positions, then attempted to liquidate or transfer cryptocurrency assets to attacker-controlled wallets. BleepingComputer tracked around $2.57 million in POL tokens being moved from a wallet suspected to be controlled by the hackers into three additional addresses.
DebugBear acknowledged it was managing a security incident and urged clients to remove its embedded code, but has not yet disclosed how attackers infiltrated its infrastructure.
Immediate Measures and Reimbursement Plans
At 2:05 p.m. Eastern, Polymarket activated a cancel-only mode, blocking new trades but allowing existing ones to be canceled. Trading resumed just after 3:05 p.m., following confirmation that the threat had been contained. According to Polymarket, the issue was reported to UK law enforcement, and full trading functionality was subsequently restored.
According to CNBC, Polymarket stated on Discord that clients with losses under $10,000 would receive reimbursements by Friday (Oct. 30), while those with greater losses would need to sign release agreements. The breach impacted Polymarket’s international exchange, Polymarket.com, and did not involve the separately regulated Polymarket US.
Recent Security Challenges
This incident is not the first time Polymarket has faced security issues. In June, CoinDesk reported on an earlier third-party compromise that resulted in approximately $3 million in user losses.
- Author
Daniel Williams
