Polymarket halts trading after supply-chain breach plants crypto-draining script

Prediction market Polymarket temporarily halted trading on Thursday, October 29, 2026, after attackers compromised a third-party provider and used it to distribute cryptocurrency-draining JavaScript that abused users' logged-in trading sessions. According to BleepingComputer, which analyzed the attack, roughly $2.5 million in assets was traced to a suspected attacker wallet. Polymarket said, "One of our third party providers was compromised, and we have referred this to relevant law enforcement."

What happened

BleepingComputer reports that the malicious script was hosted on a domain belonging to DebugBear, a website performance-monitoring service whose Real User Monitoring (RUM) product embeds JavaScript into customer websites. The script was first identified by threat intelligence firm Hudson Rock. According to BleepingComputer's analysis, the code checked whether a visitor was logged into Polymarket and then used that existing session to make unauthorized transactions, selling some users' positions and attempting to transfer prediction-market tokens to an attacker-controlled wallet. The script also tried to convert victims' holdings into transferable assets and communicated with data.debugbear.com to receive instructions and exfiltrate account, wallet and balance data.

BleepingComputer notes that using DebugBear's own infrastructure for both delivery and command-and-control raises questions about how deeply the attackers had penetrated DebugBear's systems. The outlet said it had contacted both companies and would update its report.

How much was taken

Hudson Rock identified the attacker wallet embedded in the script, which held about $2.19 million at the time of its investigation, according to BleepingComputer. The outlet said it found the wallet had transferred roughly 28.6 million POL, worth about $2.57 million, to three additional wallets. Polymarket has not disclosed how many users were affected or the total amount stolen.

Timeline and response

Citing on-chain and build evidence, BleepingComputer laid out a timeline in which attacker transactions began in the early afternoon (ET), a production build removing the DebugBear script was committed, and Polymarket moved the exchange to cancel-only mode before halting trading entirely at roughly 2:37 p.m. Trading resumed about an hour later, around 3:05 p.m., once the issue was marked resolved. Polymarket said on X, "We'll make this right and are fully reimbursing all affected traders," adding that "Anyone who has been impacted will be made whole." DebugBear said it was "impacted by an ongoing security incident" and urged RUM customers to remove its embed code from their websites; its site was returning a Cloudflare error at the time of BleepingComputer's report.

Who is affected

The incident is a reminder that third-party scripts loaded into a website inherit the trust and active sessions of its users. BleepingComputer did not attribute the attack to a named threat actor. Organizations that embed DebugBear's RUM product were advised to remove the embed code, and any platform relying on third-party JavaScript should review the integrity and necessity of those dependencies.