Prediction-market platform Polymarket paused trading on Thursday 29 October after attackers used a compromised third-party service to deliver cryptocurrency-draining JavaScript to its website. Polymarket says one of its third-party providers was compromised, that the issue has been fixed, that it has referred the matter to law enforcement, and that anyone affected “will be made whole.” Its status page shows the exchange in cancel-only mode from about 2:05 p.m. ET, with the incident marked resolved an hour later.
According to BleepingComputer, security firm Hudson Rock traced the malicious script to a file hosted on infrastructure belonging to DebugBear, a website performance-monitoring service. BleepingComputer’s own analysis of the script found that it checks whether a visitor is logged in to Polymarket, then tries to use that live trading session to sell the person’s prediction-market positions or move their tokens and other assets to an attacker-controlled wallet. DebugBear has said it is investigating an ongoing security incident and told customers to remove its monitoring code from their sites. BleepingComputer found about $2.5 million traced to a suspected attacker wallet. Polymarket has not said how many users were affected or how much was stolen, and it has not explained how reimbursement will work.
This is not the first time a third-party script has been the weak point: in June, Polymarket users lost money after malicious code was injected into the site through a compromised vendor (see our earlier post).
How to check if you’re affected
Affected products are Polymarket.com accounts that were logged in and active on 29 October, and any website that embeds DebugBear’s real-user-monitoring (RUM) script.
- If you trade on Polymarket: review your positions, balances and transaction history for 29 October. BleepingComputer reports the attacker wallet was active between 1:50 p.m. and 1:56 p.m. ET, shortly before trading was halted, so unexpected sales or transfers around then are the thing to look for. Polymarket says affected traders will be reimbursed; the company has not yet published how to claim.
- If you run a website that uses DebugBear’s RUM product: DebugBear’s own warning is to remove the embed code from your site. Polymarket’s build metadata, as found by Hudson Rock, shows it removed the integration the same day.