Polymarket Hack Drains $2.7 Million as Malicious Script Targets User Wallets

Polymarket suffered a security breach that reportedly drained approximately $2.7 million from user wallets after attackers compromised a third-party website monitoring tool called DebugBear. Malicious JavaScript injected into the prediction market's international frontend enabled unauthorized transactions, including the sale of user positions and transfers of crypto assets.

Blockchain analytics firms traced approximately $2.65 million in assets to a suspected attacker-controlled wallet, while reports indicated that around 700 user wallets were affected.

Polymarket temporarily restricted trading on October 29, placing its international platform in cancel-only mode and pausing relayer operations. The company later confirmed that it had identified and fixed the issue, resumed trading, and would fully reimburse affected users.

The incident did not involve a confirmed smart-contract vulnerability. Instead, it exposed the risks associated with third-party software integrated into cryptocurrency platforms.

No confirmed smart-contract exploit, but frontend security failed

One important distinction in the Polymarket incident is that investigators have not identified a smart-contract vulnerability as the cause of the losses.

The attack reportedly exploited the website's frontend and authenticated user sessions. This allowed malicious code to interact with existing trading functionality and initiate unauthorized transactions.

That makes the incident a supply-chain security problem rather than a conventional DeFi smart-contract exploit.

Third-party monitoring tools, analytics scripts, advertising integrations, and other external services often receive access to website environments. If attackers compromise one of these providers, they may be able to distribute malicious code through otherwise legitimate websites.

For crypto platforms, the consequences can be serious because users often connect wallets and authorize transactions through their browser sessions.

Polymarket faces another security challenge

The latest incident adds to Polymarket's recent security history.

In June 2026, a compromised third-party provider reportedly allowed attackers to inject malicious code into the platform's frontend, resulting in approximately $3 million in user losses.

The October incident therefore raises further questions about how prediction market platforms manage external software dependencies and protect authenticated trading sessions.

Polymarket has also been expanding its mainstream presence. The platform recently became one of the NBA's preferred prediction market exchanges alongside Kalshi, as covered in our report on the NBA's partnerships with Kalshi and Polymarket.

The new security incident arrives as prediction markets attract greater attention from users, investors, and regulators.

What happens next?

Polymarket has restored trading on its international platform and promised full reimbursement to affected users. The company has also referred the incident to law enforcement and removed the compromised third-party integration.

The next steps will involve completing the investigation, confirming the number of affected accounts, and processing reimbursements.

For the wider crypto industry, the breach highlights a security risk that extends beyond smart contracts and wallet private keys. External monitoring tools and website integrations can also become attack vectors when they have access to authenticated user environments.

As crypto platforms continue adding third-party services to improve performance and user experience, securing those integrations will remain an important part of protecting customer funds.