Prediction market platform Polymarket suspended operations on the evening of October 29 for about one hour after discovering that an attack on a third-party provider had compromised its international platform. The incident, which resulted in the loss of approximately $2.7 million in user cryptocurrency, illustrates a growing pattern of supply-chain vulnerabilities affecting digital services — even companies with hundreds of millions in revenue and billions in transactions can be vulnerable to attack vectors that seem deceptively simple.
The attack began around 2:00 PM Eastern when Polymarket entered "cancel-only" mode and paused relayer actions — the component that submits users' signed transactions to the blockchain. Users reported that assets were being withdrawn from their accounts without authorization. The platform confirmed that one of its third-party providers had been compromised and that the investigation had been referred to UK authorities.
Polymarket identified and fixed the issue around 2:37 PM and announced trading would resume at 3:00 PM. By 3:05 PM, its status page marked the incident as resolved, with all systems operational. But the damage was already done.
The attack vector: a performance monitoring script
The source of the compromise was DebugBear, a UK-based website performance monitoring service. DebugBear is not a bank or a payment system — it is a tool that analyzes webpage load speeds for website owners. The kind of service that thousands of companies use daily and that virtually nobody considers as an attack surface.
According to Hudson Rock, a cybersecurity firm that analyzed the incident, a script loaded from DebugBear contained code designed to look for authenticated Polymarket trading sessions, attempt to liquidate users' positions, and transfer assets to an attacker-controlled wallet. The malicious JavaScript, when executed in any user's browser visiting the platform at that moment, automatically tried to sell prediction market positions and transfer cryptocurrency.
The suspected attacker's wallet address, identified as 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18, was embedded directly in the script as the fallback recipient. Blockchain records show the wallet conducted numerous transactions involving Polymarket's prediction market token contract between 1:50 PM and 1:56 PM ET, shortly before trading was suspended.
Data from blockchain analytics platform Arkham showed the attacker's wallet held approximately $2.65 million in POL — Polygon's native token — after multiple USDC.e-to-POL swaps through the cross-chain Relay service.
A recurring pattern
This is not Polymarket's first security incident in 2026. On June 25, the platform reported that a third-party vendor had been compromised and that a malicious script had injected code into the frontend, stealing approximately $3 million from fewer than 15 accounts. A month earlier, in May, a private key compromise drained roughly $700,000 from an internal top-up wallet.
In all three cases — May, June, and October — the result was the same: user fund losses, Polymarket promising full reimbursement, and the attacker vanishing into the blockchain. The difference is that October's incident was the broadest yet, affecting not just dozens of accounts but potentially every user of the international platform.
What is instructive about this incident is not just the amount stolen, but the nature of the attack vector. This was not a sophisticated exploitation of Polymarket's smart contracts. There was no compromise of the blockchain itself. Instead, this was an attack on the user experience — a script loaded from a performance monitoring tool that, once executed in the browser, had access to authenticated sessions.
The supply-chain problem in digital services
The Polymarket case exposes an uncomfortable truth about modern infrastructure: a digital service's security depends on the security of its vendors as much as on its own. And when the compromised vendor is an apparently innocuous web monitoring tool, the attack surface expands to every company that uses that service.
DebugBear did not release additional details about the incident beyond confirming it was "impacted by an ongoing security incident" and asking customers to remove their embed codes immediately. The company did not disclose how many other companies were affected or whether Polymarket was its only compromised customer.
What is particularly frustrating for investigators is that Polymarket, unlike traditional crypto exchanges, does not store user funds in centralized wallets. Users interact with the platform through self-custodial wallets. The attack did not exploit Polymarket's smart contracts — it exploited the user's browser session. This means that, technically, the funds were never at risk of being drained from the blockchain; they were drained because the malicious script executed signed transactions automatically.
What comes next?
Polymarket has reimbursed all affected users and resumed operations. But the incident raises important questions about the security of blockchain-based financial platforms. In a sector where code security is frequently presented as the solution to intermediary financial risks, an attack that exploits a simple JavaScript script is a reminder that the most dangerous attack surface remains the user interface.
Polygon, the blockchain on which Polymarket operates, was not affected by the incident. The platform's smart contracts continued operating normally. The problem was exclusively frontend: the user experience that, when visiting the site, loaded a compromised script exploiting authenticated session trust.
It remains to be seen whether this type of attack — exploiting software supply chains through a single third-party provider — will become the new pattern for financial crimes on blockchain, and whether prediction market platforms, operating in an increasingly hostile regulatory environment, will be able to defend against such broadly replicable vectors.
Sources: CNBC, Bleeping Computer, Decrypt
✓ Independent sources cross-checked and verified before publishing
