Skip to content
NewA calmer, faster ZeroHour
StoryData breachhigh

Polymarket restores trading after third-party script drains wallets

6 sources · 7 articlesFirst reported Updated ()1
What's new

October 30: Hacker News reports a person familiar named DebugBear, British law enforcement was notified, and Polymarket declined to address Arkham’s $2.65 million figure.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Polymarket has restored international trading after a third-party script drained wallets and says affected traders will be reimbursed.

Polymarket halted international trading on October 29, 2026, after a compromised third-party service served cryptocurrency-draining JavaScript to Polymarket.com users, then restored trading and said affected traders will be fully reimbursed. Hacker News said the attack appeared to come from the United Kingdom and that Polymarket itself was not breached; its US exchange was unaffected, and the case was referred to British law enforcement. BleepingComputer, Cyber Security News, and The Record cite Hudson Rock identifying DebugBear-hosted JavaScript that reused logged-in sessions; a person familiar with the incident also named DebugBear, which Polymarket has not confirmed. Hacker News said the halt lasted several hours, while BleepingComputer, SecurityWeek, and a later Hacker News report said about or nearly an hour. Outside loss estimates conflict and Polymarket has not confirmed them: Bubblemaps about 700 users and $2.7 million; Hudson Rock about $2.57 million; GoPlus about $2.71 million; Arkham about $2.65 million; The Record says firms allege more than $2.1 million.

Key facts
  • International Polymarket.com halted October 29; Polymarket US was not affected.
  • Hudson Rock and a person familiar named DebugBear; Polymarket has not confirmed the vendor.
  • Cancel-only mode began about 2:05 p.m. ET; trading was marked resolved at 3:05 p.m. ET.
  • Cyber Security News: claims under $10,000 were told funds would return by October 30.
  • GoPlus traced a path through 710 deposit wallets and 731 addresses.
  • DebugBear told real-user-monitoring customers to remove its embed code.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 29, 2026Production build removed the DebugBear script at 1:59 p.m. ET. · BleepingComputer
  2. Oct 29, 2026International outages began around 2 p.m.; cancel-only mode followed. · The Record
  3. Oct 29, 2026DebugBear posted about an ongoing security incident around 2 p.m. ET. · Hacker News
  4. Oct 29, 2026Trading resumed near 3 p.m. ET and was marked resolved at 3:05. · BleepingComputer

What each outlet adds

beyond the shared facts
  • Hacker NewsUK origin, British police referral, and unconfirmed Discord drain reports.
  • BleepingComputerScript host, suspect wallet, and exact halt and resolution times.
  • Cyber Security NewsOctober 30 small-claim timeline and larger claims needing a release.
  • SecurityWeekGoPlus wallet counts beside Hudson Rock and Arkham totals.
  • The RecordHudson Rock saw no evidence other DebugBear customers were compromised.
Vendors
DebugBearPolymarket
Products
DebugBear RUMPolymarketDebugBear Real User MonitoringPolymarket.comPolymarket US
Victims
Polymarket
Organizations
Hudson RockGoPlusArkhamThe BlockBubblemaps
Countries
United KingdomUnited States

Coverage

oldest first · one row per article · UTC
  1. · 1d ago Hacker News · securityFirst report

    Polymarket paused international trading after a vendor breach

    A UK third-party provider was breached; trading resumed and Polymarket says affected traders will be refunded.

  2. · 1d ago BleepingComputer

    Polymarket halts trading after crypto-draining script breach, $2.5M traced

    Hudson Rock linked a wallet in DebugBear-hosted JavaScript to about 28.6 million POL, roughly $2.57 million.

  3. · 20h ago Cyber Security News

    Polymarket users report stolen funds after third-party script compromise

    Hudson Rock says malicious JavaScript from a DebugBear address reused logged-in sessions; $2.7 million across 710 wallets is an outside estimate.

  4. · 18h ago GBHackers

    Polymarket halts trading after third-party compromise, pledges full reimbursement

    Users report unauthorized withdrawals and zero balances; the provider, loss totals, and access path remain undisclosed.

  5. · 14h ago SecurityWeek

    Polymarket traders drained after DebugBear monitoring script compromised

    Trading on the international site paused for about an hour on October 29, and Polymarket says affected users will be reimbursed.

  6. · 12h ago The Record

    Polymarket confirms third-party compromise after trading outage

    Blockchain firms allege more than $2.1 million was siphoned; Hudson Rock names DebugBear, which Polymarket has not confirmed.

  7. · 9h ago Hacker News · security

    Polymarket halts international trading after third-party compromise

    Trading on Polymarket.com resumed after nearly an hour; the US platform was not affected and the company promised reimbursement.