Polymarket Users Lose Estimated $2.71 Million in Third-Party Script Attack

Polymarket users lost approximately $2.71 million in an October 29 attack involving a compromised third-party website script, according to security company GoPlus.

Its blockchain analysis identified 710 deposit wallets and 731 addresses along the principal attack path. GoPlus cautioned that these address counts do not establish the number of individual users affected. Polymarket has promised to reimburse affected traders but has not published a final loss assessment. 

Malicious Code Targeted Active Trading Sessions

Researchers at Hudson Rock identified wallet-draining code in a script served through infrastructure belonging to DebugBear, a British website performance-monitoring provider.

The script searched for users’ active Polymarket trading sessions, inspected their portfolios and attempted to redirect assets. Depending on the account type, its code sought either to transfer position tokens directly or sell positions before transferring available balances.

Hudson Rock’s findings were based on examination of the retrieved code. The researchers did not execute it against a connected wallet and stressed that the presence of a transaction or signature request did not prove that every attempted action succeeded. 

Trading Resumed After Approximately One Hour

Polymarket initially restricted its exchange to order cancellations and paused transaction-relaying functions while investigating. Trading returned approximately one hour after the initial suspension.

The platform said it had identified and fixed the vendor-related issue and referred the incident to UK law enforcement. DebugBear separately acknowledged a security incident and instructed customers using its Real User Monitoring product to remove the embedded code from their websites. 

Hudson Rock also found production-build records documenting Polymarket’s removal of the DebugBear integration. Its investigation did not establish the initial compromise mechanism or demonstrate that other DebugBear customers had been affected. 

Larger Reimbursements Reportedly Require a Release

According to CNBC, Polymarket subsequently told users on Discord that those who lost less than $10,000 would have their funds restored by October 30.

Users with losses above that threshold were reportedly required to sign a release form before receiving reimbursement. The report did not establish the treatment of losses exactly equal to $10,000 or detail the release’s full terms. 

The reimbursement timetable represents the platform’s stated commitment. It does not confirm that all affected users have already received their money.