Prediction market platform Polymarket temporarily suspended trading after a third-party service was compromised and used to distribute malicious JavaScript designed to drain cryptocurrency from user accounts, with about $2.5 million (₹23.73 crore) in assets traced to a suspected attacker-controlled wallet.
Polymarket said the incident affected its international platform, Polymarket.com, and that the issue had been identified and fixed. The company referred the matter to law enforcement and said affected users would be reimbursed.
The platform initially switched to cancel-only mode and paused relayer actions while investigating the breach. Trading was later halted as a precaution before being restored roughly an hour after the initial suspension.
https://the420.in/fcrf-certified-chief-ai-officer-second-cohort-november-2026/
Malicious Script Targeted Logged-In Users
Security researchers at Hudson Rock identified malicious JavaScript delivered through infrastructure belonging to DebugBear, a website performance-monitoring company.
The script was designed to detect whether a visitor was logged into Polymarket and then use the existing authenticated session and trading functionality to carry out unauthorised transactions.
According to analysis of the malicious code, the script checked users’ cryptocurrency balances and prediction-market positions to determine the value of their holdings.
Depending on how a user had authenticated to the platform, the malware could attempt to sell prediction-market positions automatically, transfer prediction-market tokens directly to an attacker-controlled wallet, or convert cryptocurrency holdings into assets that could then be transferred.
The script also communicated with infrastructure at data.debugbear.com, which researchers said was used to receive instructions and transmit information about targeted accounts, wallet addresses, balances and transaction results.
The use of DebugBear infrastructure for both distribution and communication with the malicious code raised questions about the extent of the compromise affecting the third-party service.
Around $2.5 Million Traced to Suspected Attacker Wallet
Hudson Rock identified a wallet believed to be controlled by the attacker and embedded in the malicious JavaScript.
Blockchain activity examined after the incident showed that the wallet transferred about 28.6 million POL, valued at roughly $2.57 million, to three additional wallets.
The same wallet also carried out multiple transactions involving Polymarket’s prediction-market token contract shortly before the exchange suspended trading.
At one point during the investigation, the suspected attacker wallet reportedly held around $2.19 million in cryptocurrency.
Polymarket has not disclosed how many users were affected, the total amount stolen, or details of how reimbursements will be processed.
The company said that anyone affected would be made whole and later confirmed that trading had returned to normal.
DebugBear Investigates Third-Party Compromise
DebugBear acknowledged that it was dealing with an ongoing security incident and advised customers using its Real User Monitoring product to remove the embedded monitoring code from their websites.
The company’s monitoring service uses JavaScript placed on websites to collect performance and user-experience data from visitors’ browsers.
Researchers also found Polymarket production metadata indicating that the DebugBear monitoring script had been removed from the platform shortly before the incident was publicly announced.
At the time of the investigation, DebugBear’s website was unavailable and displayed a Cloudflare error, though it was not immediately clear whether the outage was part of containment efforts or another consequence of the incident.
The breach illustrates the risks created when trusted third-party JavaScript is embedded into financial and crypto platforms. Even where a platform’s own systems are not directly breached, compromised external services can provide attackers with a path into active user sessions.
Polymarket said the issue had been fixed and trading fully restored, while law enforcement authorities were notified and affected traders were promised reimbursement.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
