An estimated $2.7 million was reportedly drained from more than 700 accounts on the international Polymarket exchange on October 29, and the way the money moved upends the security advice most crypto traders live by. Casino.org first reported that attackers reached the prediction market through a compromised third-party script, not through any mistake by the traders themselves.
That distinction is the whole story for this site’s readers. The usual advice for keeping a wallet safe, never click a phishing link, never type a seed phrase, never approve a suspicious transaction, assumed the danger arrives from outside the site. Here it ran inside the genuine Polymarket site. Cybersecurity researchers at Hudson Rock identified a modified script hosted on the infrastructure of DebugBear, a UK-based provider of website performance-monitoring software, that targeted traders’ logged-in sessions.
The code did everything a victim would never agree to do
The malicious JavaScript scanned active balances and open prediction-market positions, automatically liquidated holdings and transferred the assets to an attacker-controlled wallet, an analysis by BleepingComputer found, as Casino.org reported. No click was needed. A trader who opened the legitimate site in an ordinary browser session was exposed all the same. Polymarket has confirmed neither number. The roughly $2.7 million estimate belongs to the on-chain analysts at Bubblemaps.
On-chain analysis could follow the money precisely because the movement left a permanent trail. Tracing on Polygon tied roughly $2.57 million in POL token to a single central wallet that distributed funds across three addresses, and that public trail is what let analysts estimate the wider loss and the headcount of roughly 700 accounts.
Polymarket said in a post on X: “One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement.” The company placed its international exchange into cancel-only mode at 2:05 p.m. Eastern on October 29, halting new orders while allowing open bids to be canceled, and normal trading resumed by 3:05 p.m., according to the platform’s status page. The breach did not touch Polymarket US, which operates separately under US financial regulation.
Advice is no longer the perimeter
This was Polymarket’s second supply-chain breach in four months: Casino.org reported that a June 2026 vendor compromise drained roughly $3 million from user wallets. Two vendor failures that close together matter to any platform the size of Polymarket, which has spent 2026 fighting for US market access while it courts regulators and courts alike. The bigger lesson, though, is about the plumbing every site shares. Any platform that embeds third-party measurement, analytics or chat scripts is trusting those vendors with its users’ sessions, and a single compromised snippet can turn the safest habits into no defense at all.
DebugBear acknowledged an ongoing security incident and urged every customer using its performance-monitoring product to remove the embedded snippet from their websites while outside investigators assess the breach.
Reimbursement carries conditions. Polymarket told users on Discord, according to CNBC, that traders who lost under $10,000 would have funds restored by October 30. Larger losses require signing release agreements before payment, which leaves the biggest victims trading their legal rights for recovery.
The company has fixed the issue and said it will make affected customers whole, and the law-enforcement referral remains open with no public outcome so far.
Responsible gambling guidance is available at InsideBitcoins.
