Polymarket Suspends Trading After $2.7 Million Drained in Third-Party Software Breach

Polymarket saw an estimated $2.7 million siphoned from hundreds of accounts on its international cryptocurrency platform on October 29. The breach occurred through software supplied by a third-party provider, prompting the operator to place the exchange into cancel-only mode for about an hour before restoring service. The company has since fixed the vulnerability, referred the matter to UK law enforcement, and committed to reimbursing all affected traders.

Attack Vector Involved Website Code Tampering

Security researchers at Hudson Rock identified a modified script on DebugBear infrastructure that targeted logged-in sessions. The code, as detailed by BleepingComputer, checked cryptocurrency balances and open prediction-market positions before selling holdings or transferring assets to attacker-controlled wallets. This allowed losses without phishing links or password disclosure.

Blockchain analytics firm Bubblemaps estimated around 700 users were affected on the international platform, which operates separately from the regulated Polymarket US. BleepingComputer traced transactions involving approximately $2.57 million in Polygon’s POL cryptocurrency from a suspected attacker wallet to three other addresses. DebugBear acknowledged the security incident and urged customers to remove its embedded Real User Monitoring code.

Platform Response and Prior Incidents

Polymarket placed its exchange into cancel-only mode at 2:05 p.m. Eastern on Thursday and resumed normal trading around 3:05 p.m., according to its status page. As first reported by Casino.org News, the company stated that one of its third party providers was compromised. Traders losing less than $10,000 are to receive funds restored by October 30, while those with larger losses must sign release agreements before reimbursement.

This marks the second such incident. In June, another third-party breach resulted in approximately $3 million stolen from users.