Polymarket Traders Lose $2.7 Million in Script Hijack

Malicious code on Polymarket’s site substituted a page-speed script loaded from DebugBear, a real-user monitoring tool, and enabled unauthorised access to users’ open trading sessions on 29 October 2026. Hudson Rock’s review of the embedded file showed it re-used a trader’s browser-held account details and trading API keys to identify the signing and ordering components on Polymarket’s site, then redirected the signing requests to Polymarket’s relayer.

In practice, accounts signed in with a crypto wallet had their positions moved directly to the attackers’ wallet, while accounts signed in via email faced a dumping of positions at unfavourable prices before funds were withdrawn.

Blockchain tracing by Ohey tracked the attacker wallet receiving the initial funds between 17:10 and 18:02 UTC, accumulating 28.6 million POL tokens and positions from 33 wallets; by 18:19 UTC those POL tokens were worth about $2.64 million, according to DefiLlama’s price. The same wallet then sent the funds to three other addresses between 18:28 and 18:38 UTC.

Polymarket disclosed the incident publicly, stating it began removing the compromised script within the hour, paused relayer actions and trading, and referred the case to law enforcement. By 30 October, 689 of 726 affected wallets had been refunded in full, with a further $1.19 million paid to about 5,500 traders who lost money during the trading pause or had positions drained, bringing the total refunds to $3.9 million.

Polymarket urged traders to check status updates via its page and to file claims if necessary. DebugBear advised its customers to remove the compromised embed code, and Polymarket indicated it would reintroduce third‑party scripts with tighter controls, including stronger Content Security Policy, pinned versions, and sandboxing. Hudson Rock recommended removing unnecessary third‑party code from trading pages, employing Subresource Integrity where possible, and ensuring traders reject unexpected signing requests.