Prediction market platform Polymarket temporarily suspended trading on Thursday after hackers compromised a third-party service to distribute cryptocurrency-draining JavaScript, with approximately $2.5 million in assets traced to a suspected attacker wallet.
The company confirmed the security incident, saying it had identified and fixed the issue affecting its international platform, Polymarket.com, and referred the breach to law enforcement.
“One of our third party providers was compromised, and we have referred this to relevant law enforcement,” Polymarket said.
“Anyone who has been impacted will be made whole. Out of an abundance of caution, we have temporarily halted trading and are working to bring the platform back online.”
Polymarket initially placed its exchange into cancel-only mode at 2:05 p.m. ET and paused relayer actions while investigating the incident. At 2:37 p.m., the company announced that the issue had been fixed and that trading was temporarily halted out of an abundance of caution.
Trading resumed approximately one hour after the initial suspension, with the incident marked resolved at 3:05 p.m. ET.
“Trading is now fully back online,” the company announced on X. “We’ll make this right and are fully reimbursing all affected traders.”
Polymarket has not disclosed how many users were affected, how much cryptocurrency was stolen, or how the reimbursement process will work.
Security researchers at Hudson Rock identified a suspected attacker-controlled wallet (0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18) embedded in the malicious JavaScript.
BleepingComputer’s examination of the wallet’s blockchain activity found that it transferred approximately 28.6 million POL, valued at roughly $2.57 million, to three additional wallets.
Blockchain records also show that the wallet conducted numerous transactions involving Polymarket’s prediction-market token contract between 1:50 p.m. and 1:56 p.m. ET, shortly before the exchange suspended trading.
Hudson Rock reported that the wallet held approximately $2.19 million in cryptocurrency at the time of its investigation.
Malicious JavaScript used to drain wallets
Security researchers at Hudson Rock identified malicious JavaScript distributed through cdn.debugbear[.]com/C7xcKKrjUnXK.js that was designed to steal cryptocurrency and prediction-market holdings from Polymarket users.
The script was hosted on infrastructure belonging to DebugBear, a website performance-monitoring service that helps organizations track website loading speeds and user experience.
DebugBear’s Real User Monitoring (RUM) service uses JavaScript embedded in websites to collect performance metrics from visitors’ browsers.
DebugBear has since confirmed that it is investigating an ongoing security incident and warned customers to remove its monitoring JavaScript from their websites.
“We’re impacted by an ongoing security incident,” DebugBear said in a post on X.
“If you use our RUM product, please remove the embed code from your website.”
At the time of writing, DebugBear’s website was inaccessible, displaying a Cloudflare error. It is unclear whether the website outage is related to containment efforts or another consequence of the incident.
Hudson Rock’s researchers also discovered Polymarket production build metadata containing the commit message, “chore(polymarket): remove debugbear rum script (#15337),” indicating that the platform had removed the DebugBear monitoring integration.
The build was timestamped October 29 at 1:59 p.m. ET, shortly before Polymarket publicly announced the incident.
BleepingComputer analyzed a copy of the malicious JavaScript file (VirusTotal), finding that it was designed to hijack authenticated Polymarket trading sessions, liquidate users’ prediction-market positions, and transfer cryptocurrency and other assets to an attacker-controlled wallet.
The malware checks whether a visitor is logged into Polymarket and attempts to use their existing trading session and the platform’s trading functionality to carry out unauthorized transactions.
It then checks the user’s cryptocurrency balances and prediction-market positions to determine the value of their holdings.
Depending on how the user authenticated to Polymarket, the malware attempts to steal their assets in different ways.
For some users, it tries to automatically sell their prediction-market positions. For others, the malware attempts to transfer their prediction-market tokens directly to an attacker-controlled wallet.
Source: BleepingComputer
The malware also attempts to convert users’ cryptocurrency holdings into assets that can be transferred to an attacker-controlled wallet, using Polymarket’s existing transaction functionality.
BleepingComputer found that the malicious script communicated with data.debugbear.com to receive instructions and send data about targeted accounts, wallet addresses, balances, and transaction results.
The use of DebugBear’s infrastructure to both distribute the malicious script and serve as a command-and-control (C2) and data exfiltration server raises questions about the how much access the attackers had to the company’s systems.
BleepingComputer has contacted Polymarket and DebugBear with questions about the incident and will update this article if we receive a response.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.