Polymarket hack explained: how $2.65M was stolen

On Oct. 29, funds started draining from Polymarket traders' wallets. A malicious script on the website sold users' positions on its own and sent the money to an attacker. Arkham data cited by The Block shows the suspected attacker ended up with about $2.65 million in POL. Polymarket put its exchange in cancel-only mode for about an hour, blamed a compromised third-party provider and promised to make affected users whole.

What we know now

• Polymarket says a third-party provider was compromised (status page); per Hudson Rock, the attack ran through that vendor's code on polymarket.com, not through smart contracts.
• The attacker holds about $2.65 million in POL (Arkham via The Block). Polymarket has not disclosed total losses or the number of victims.
• Hudson Rock ties the attack to a script from DebugBear, a website performance monitoring service (Infostealers). Polymarket has not named the vendor, and DebugBear has not commented publicly.
• The company says it found and fixed the issue and referred the case to law enforcement. Trading resumed around 3 PM ET (BNO News).
• Polymarket says everyone affected will be compensated. It has not announced a timeline or process.

How it happened

This was a supply-chain attack: the attackers compromised a service whose code runs on the site, not Polymarket itself. According to Hudson Rock's analysis, the file cdn.debugbear.com/C7xcKKrjUnXK.js (15,187 bytes) did the following on Polymarket's site:

• read the logged-in user's session data from browser storage;
• located Polymarket's trading client in the page code and checked the portfolio;
• for some account types, moved position tokens directly; for others, first placed sell orders at progressively worse prices, then moved the remaining balance;
• signed batch transfers (EIP-712 DepositWallet messages on Polygon) through the signer already connected in the browser and submitted them to Polymarket's relayer.

Users did not have to approve anything manually. Having the site open with an active session was enough, which is why Polymarket paused both trading and the relayer that processed those transfers.

Timeline

Oct. 29, around 1:30 PM ET. Funds start draining automatically from user wallets, BNO News reports.

Oct. 29, 1:59 PM ET. Polymarket builds a new version of its site with the change "remove debugbear rum script," according to build metadata published by Hudson Rock.

Oct. 29, 2:05 PM ET. The status page says the exchange is in cancel-only mode and relayer actions are paused. Orders can be canceled, but no new trades go through.

Oct. 29, 2:12 PM ET. Hudson Rock downloads the malicious file from DebugBear's CDN. By then Polymarket's homepage no longer references DebugBear.

Oct. 29, 2:37 PM ET. Polymarket says it identified and fixed the issue on its international platform: "One of our third party providers was compromised, and we have referred this to relevant law enforcement" (status). In a post quoted by Decrypt, it adds: "Anyone who has been impacted will be made whole."

Oct. 29, 2:41 PM ET. crypto.news collects trader reports. A user called Car says $800,000 was stolen, plus about $600,000 from a friend. An account called StarPlatinum claims $2.68 million, which is unconfirmed.

Oct. 29, 2:55 PM ET. Polymarket says trading will resume at about 3 PM ET.

Oct. 29, 3:00 PM ET. The Block, citing Arkham, reports a wallet holding about $2.65 million in POL.

Oct. 29, 3:05 PM ET. The status page marks the incident as resolved.

Where the money went

According to Arkham (The Block), the attacker swapped stolen USDC.e into POL through Relay in a series of trades, then moved the funds to other addresses. The script had a hardcoded fallback recipient on Polygon, 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18. Hudson Rock's snapshot showed about $2.19 million in POL and other tokens there. The researchers caution against simply adding that figure to the reported $800,000 loss, because the two may overlap.

There are no reports yet of the funds reaching exchanges or mixers.

What the team and exchanges did

• Polymarket halted trading and the relayer, removed the DebugBear script from its site and restored trading about an hour later.
• It referred the case to law enforcement and pledged full compensation for victims.
• No freezes of the attacker's funds by exchanges or stablecoin issuers have been reported so far.

This is Polymarket's third security incident in six months. In May, a private key for an internal-operations wallet leaked and more than $500,000 was taken (ForkLog). In June, a compromised vendor injected phishing code into the site, with losses of about $3.1 million (CoinDesk), and Polymarket refunded users then as well.

What it means for holders

The victims were users logged in to polymarket.com while the malicious script was live. There are no reports that the platform's contracts themselves were breached. Users who see position sales or transfers they did not make should watch Polymarket's official channels, since the compensation process has not been announced. Be wary of "recovery helpers" on social media: after hacks they usually turn out to be scammers.

We use Polymarket odds in our daily brief. They may have lagged while trading was paused.

This is not investment advice.

This story is developing: we are tracking events and adding new information. Last updated Oct. 29, 3:15 PM ET.