Polymarket Hackers Steal 2.7 Million Dollars Through Compromised Script

On October 29, the Polymarket prediction market suffered a security breach when malicious code was injected into the website. The attackers replaced an outside page-speed script loaded from an external company named DebugBear.

• The incident took place on October 29.
• Hackers sold signed-in traders' positions and diverted funds.
• A total of 726 wallets were affected, losing about $2.7 million.
• Polymarket announced it is issuing full refunds to all affected users.

Details of the Supply Chain Attack

The malicious script successfully bypassed standard frontend protections by masquerading as a legitimate performance monitoring tool from DebugBear. This classic supply chain vector allowed attackers to target active traders directly on the platform.

Blockchain records confirmed that crypto worth approximately $2.64 million successfully reached the hackers' wallets. The malicious script specifically targeted users who were actively signed in during the exploit window.

Platform Response and User Refunds

Polymarket acted swiftly following the incident, stating that it will fully reimburse the 726 affected wallet holders. The total refund amount is estimated to be around $2.7 million.

On-chain analytics and transparency allowed the platform's security team to quickly track the stolen funds and identify all impacted accounts to ensure proper compensation.

Implications for Web3 Platforms

This security breach highlights the inherent risks of relying on third-party scripts and external integrations in modern web development. Ensuring robust integrity checks for all loaded assets is crucial for prediction markets and crypto platforms.