Prediction market platform Polymarket was forced to temporarily suspend operations on Wednesday, October 29, after hackers compromised a third-party software provider and managed to drain cryptocurrency funds from some users' wallets. The incident, which lasted approximately one hour, highlights a growing threat in the crypto ecosystem: it is no longer the platform's own protocols that are being targeted, but the software supply chain upon which they depend.
Polymarket announced the incident at 14:05 Eastern Time (ET), placing its international platform into "cancel-only" mode and pausing relay actions while it investigated. At 14:37, the company announced the issue had been resolved and that trading was being temporarily suspended "as an abundance of caution." Trading resumed approximately one hour later, with the incident marked as resolved at 15:05 ET. "Trading is now fully back online," Polymarket wrote in a post on the social media platform X. "We'll make this right and are fully reimbursing all affected traders."
The attack exploited DebugBear, a UK-based web performance monitoring service that provides "Real User Monitoring" (RUM) JavaScript. Polymarket had a DebugBear snippet embedded on its website, and hackers injected malicious code into the version distributed by that service. The malicious script, hosted at `cdn.debugbear.com`, was built on October 29 at 13:59 ET, minutes before Polymarket publicly announced the incident.
Security researchers at Hudson Rock identified malicious JavaScript distributed through `cdn.debugbear.com/C7xcKKrjUnXK.js` designed to hijack authenticated Polymarket trading sessions, liquidate users' positions in prediction markets, and transfer cryptocurrency and other assets to an attacker-controlled wallet. The malware also attempted to convert users' cryptocurrency holdings into assets that could be transferred to the hackers' wallet, using Polymarket's own existing transaction functionality against it.
BleepingComputer's analysis found that the malicious script communicated with `data.debugbear.com` to receive instructions and send data about targeted accounts, wallet addresses, balances, and transaction results. The use of DebugBear's infrastructure to both distribute the malicious payload and serve as a command-and-control (C2) server raises questions about the extent of the attackers' access to the company's systems.
Hudson Rock researchers identified a suspected attacker-controlled wallet (0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18) embedded in the malicious code. BleepingComputer's blockchain analysis showed the wallet transferred approximately 28.6 million POL tokens, valued at roughly $2.57 million, to three additional wallets. Blockchain records show the wallet conducted numerous transactions involving Polymarket's prediction-market token contract between 13:50 and 13:56 ET, shortly before the platform suspended trading.
Polymarket has not disclosed how many users were affected, the total amount stolen, or how the reimbursement process will work. CEO Shayne Coplan confirmed to CNBC and other outlets that the company referred the incident to British authorities, given that DebugBear is a UK-based company.
This marks the second time in a few months that Polymarket has been targeted by wallet-draining attacks. In May, a private key compromise drained about $700,000 from an internal top-up wallet. In June, the platform reported hackers had siphoned more than $2.9 million in user funds by compromising a third-party vendor. The recurrence raises serious questions about security in the prediction market ecosystem and the systemic vulnerability that third-party providers pose to crypto financial platforms.
The DebugBear case illustrates an increasingly common pattern in cyberspace: rather than attempting to directly breach a platform's own robust security, attackers target its weakest supply chain links. The strategy mirrors the SolarWinds compromise of 2020, where a single point of failure in the supply chain enabled access to thousands of organizations. In Polymarket's case, a single JavaScript snippet injected by a web performance monitoring provider was sufficient to drain millions of dollars in minutes.
What remains unclear is the scope of this latest compromise. Unlike the Binance hack earlier in the month, which involved a directly compromised engineer's laptop and was attributed to North Korean state actors, the Polymarket attack exploited a supply chain vector that could affect any website relying on DebugBear's monitoring service. The question for the broader crypto industry is whether platforms will begin mandating stricter vendor security standards, or if the third-party compromise model will continue to prove itself the path of least resistance for attackers.
Sources: Bloomberg, CNBC, BleepingComputer
✓ Independent sources cross-checked and verified before publishing
