Polymarket suffered a cyberattack that allowed hackers to empty the digital wallets of hundreds of users and steal at least USD 2.7 million, according to estimates from specialized cryptocurrency analysis firms. The incident occurred on Thursday, October 29, and forced the suspension of operations on its international platform for approximately one hour, while technical teams attempted to contain the theft.
The company confirmed that the source of the problem was an external technology provider and announced that it would compensate the affected users. In an update released on Friday, October 30, it reported that 95% of the affected wallets had already received full refunds.
How the hack that affected Polymarket occurred
The first reports began in the afternoon on Thursday, when users reported on X that their positions had been sold without authorization and that their funds had disappeared.
One of the affected operators warned: "If you are a Polymarket user, protect your account. They just emptied 800,000 dollars from mine", according to the message collected by industry researchers.
At 2:05 PM Eastern Time, Polymarket activated a mode that only allowed the cancellation of existing orders.
The company explained: "One of our external providers was compromised, and we have referred the case to the relevant authorities". It then added: "Anyone who has been affected will be compensated".
Operations were restored around 3:05 PM, after technicians removed the compromised component and verified the service's functionality.
What is DebugBear and how the malicious code was introduced
The investigation pointed to DebugBear, a British company that offers services to monitor the speed and performance of websites. Polymarket was using a program from this provider to measure the performance of its site.
However, the attackers managed to replace it with a JavaScript code designed to exploit the sessions that users already had open.
DebugBear publicly acknowledged the incident and asked its clients to temporarily remove the monitoring code from their sites.
Researchers from Hudson Rock identified functions capable of querying available balances, selling positions, and sending cryptocurrencies to a wallet controlled by the attackers.
The attack did not need to directly compromise Polymarket's smart contracts: it used the usual operational tools through compromised sessions.
