Polymarket users report stolen funds after third-party script compromise
Original title: Polymarket Hacked – Users Reported Funds Stolen From Their Wallets
Hudson Rock says malicious JavaScript from a DebugBear address reused logged-in sessions; $2.7 million across 710 wallets is an outside estimate.
Polymarket halted trading on its international platform on October 29, 2026, after users reported missing funds, unexpected withdrawals, and positions closed without permission. The company said a third-party provider was compromised, referred the case to law enforcement, later resumed trading, and pledged to reimburse affected users. Hudson Rock found malicious JavaScript served from a DebugBear address that read browser storage and tried to move assets through an active trading session. Polymarket did not name the vendor, and its US platform was reported uncompromised.
Unconfirmed: The $2.7 million figure and 710 wallets are outside estimates, and Polymarket has not named the compromised provider.
- Researchers downloaded the script twice and received identical copies.
- The code sought a live trading client and signer inside React components.
- Users under $10,000 stolen were told funds would return by October 30.
- Larger claims were reported to require a release form.
- Researchers did not run the sample, so transfer success is unproven.
Impact: Stolen funds and trading credentials from active sessions
| Product | Affected |
|---|---|
| Polymarket international platform | — |
- 1.Close potentially exposed tabs and reject unexpected signing requests.
- 2.Review recent orders and wallet transactions and save transaction hashes.
- 3.Verify reimbursement through official channels and never share a seed phrase.
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1059.007 JavaScriptT1555.003 Credentials from Web Browsers
- Vendors
- PolymarketDebugBear
- Victims
- Polymarket
- Organizations
- Hudson Rock
From the original article
2 min read at cybersecuritynews.com
Polymarket suffered a security incident on October 29, 2026, after a compromised third-party provider exposed users of its international platform to wallet theft. Traders reported missing funds, unexpected withdrawals, and positions being closed without permission. The company temporarily stopped trading, said it had fixed the issue, and promised to reimburse affected users.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.