Polymarket, a prediction market platform, halted trading on Thursday following a security breach in which attackers leveraged a compromised third-party service to distribute malicious JavaScript code designed to siphon cryptocurrency from users. Security researchers traced approximately $2.5 million in assets to a wallet believed to be controlled by the attacker. The company acknowledged the incident and stated it had remediated the vulnerability on its international platform at Polymarket.com, while also notifying law enforcement.
Polymarket issued a statement explaining the breach: "One of our third party providers was compromised, and we have referred this to relevant law enforcement. Anyone who has been impacted will be made whole. Out of an abundance of caution, we have temporarily halted trading and are working to bring the platform back online."
The platform entered cancel-only mode at 2:05 p.m. ET and suspended relayer operations while investigating. By 2:37 p.m., Polymarket announced the fix was complete and trading remained paused as a precaution. Service resumed roughly an hour after the initial halt, with the incident declared resolved at 3:05 p.m. ET. The company stated on X that "trading is now fully back online" and pledged full reimbursement to all affected users, though it has not disclosed the number of impacted accounts, total stolen funds, or reimbursement mechanics.
Malicious JavaScript used to drain wallets
Hudson Rock's security team identified malicious JavaScript served from cdn.debugbear.com/C7xcKKrjUnXK.js that targeted Polymarket users' cryptocurrency and prediction-market holdings. The script was hosted on infrastructure operated by DebugBear, a website performance-monitoring vendor that provides Real User Monitoring (RUM) services to track site loading speeds and user experience metrics through JavaScript embedded in customer websites.
DebugBear acknowledged the compromise in a post on X: "We're impacted by an ongoing security incident. If you use our RUM product, please remove the embed code from your website." At the time of reporting, DebugBear's website was unreachable, showing a Cloudflare error, though it remains unclear whether this resulted from incident containment or another cause.
Hudson Rock researchers discovered Polymarket production build metadata containing a commit message stating "chore(polymarket): remove debugbear rum script (#15337)," which suggests the platform had already removed the DebugBear integration. The build timestamp showed October 29 at 1:59 p.m. ET, shortly before Polymarket's public disclosure of the incident.
Analysis of the malicious JavaScript revealed it was engineered to intercept authenticated Polymarket trading sessions, liquidate users' prediction-market positions, and redirect cryptocurrency and other assets to an attacker-controlled wallet. The malware first checks whether a visitor maintains an active Polymarket login, then leverages the existing session and platform trading functions to execute unauthorized transactions.
The script inspects a user's cryptocurrency balances and prediction-market positions to assess holdings value. Depending on the authentication method used, it employs different asset-theft techniques: for some users it attempts automatic sale of prediction-market positions, while for others it tries direct transfer of prediction-market tokens to the attacker's wallet. The malware also seeks to convert cryptocurrency holdings into transferable assets using Polymarket's native transaction infrastructure.
The malicious code communicated with data.debugbear.com to receive instructions and exfiltrate data regarding targeted accounts, wallet addresses, balances, and transaction outcomes. The use of DebugBear's infrastructure for both malicious script distribution and command-and-control plus data exfiltration operations raises concerns about the scope of attacker access to the company's systems.
Wallet activity and attacker tracing
Hudson Rock identified a suspected attacker-controlled wallet at address 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18 embedded within the malicious JavaScript code. Blockchain examination showed the wallet transferred approximately 28.6 million POL tokens, valued at roughly $2.57 million, across three additional wallets.
Blockchain records documented numerous transactions involving Polymarket's prediction-market token contract between 1:50 p.m. and 1:56 p.m. ET, immediately preceding the exchange's trading suspension. At the time of Hudson Rock's investigation, the wallet held approximately $2.19 million in cryptocurrency.