Compromised analytics script drains Polymarket trader wallets

Polymarket suspended new transactions on 29 October 2026 after attackers compromised a JavaScript analytics script supplied by monitoring company DebugBear, according to SecurityOnline. The altered script was designed to target active Polymarket sessions and interfere with wallet and order functions. Researchers at Hudson Rock examined a 15,187-byte file taken from DebugBear’s server; SecurityOnline, citing InfoStealers, said it intercepted wallet-signing logic and read open portfolio balances. DebugBear acknowledged a security anomaly and advised customers to remove the code.

The malicious script reportedly tried to convert prediction positions into liquid tokens, then prompted users to sign Polygon EIP-712 messages. SecurityOnline said the requests appeared on Polymarket’s genuine domain, and signing could authorise contracts to drain assets. On-chain observers tracked transactions to an attacker wallet that accumulated about US$2.65 million in POL tokens; the report also said stolen USDC.e was exchanged through the Relay bridge.

Individual traders reported losses, including one account holder who said they lost US$800,000. These figures are reported claims, not a confirmed total loss.

Polymarket’s administrators said they contained the incident and resumed trading, while executives pledged to reimburse verified losses. Engineers removed the DebugBear integration at 17:59 UTC on 29 October, and the company reported the criminal activity to British law enforcement. SecurityOnline also cited a June incident in which attackers reportedly stole US$3.1 million through compromised scripts.