Polymarket News Traders Lose $2.7 Million After Hackers Compromise Third-Party Script

Polymarket News traders reportedly lost approximately $2.7 million after hackers compromised a third-party script used by the prediction market’s international website. The incident occurred on October 29, 2026, and forced the platform to temporarily suspend trading while its team investigated the suspicious activity. Rather than exploiting Polymarket’s core infrastructure directly, attackers reportedly used malicious code delivered through an external service connected to the website.

The incident raised concerns about the security of third-party tools used by cryptocurrency platforms. It also showed how a seemingly routine website component can become a serious risk when attackers gain control of the code that users’ browsers load. Polymarket later confirmed the vendor compromise, restored trading, and announced compensation for affected users.

What Happened in the Polymarket Security Incident?

On October 29, Polymarket identified unauthorized activity affecting user wallets on its international platform, Polymarket.com. The company initially restricted trading and paused relayer activity while investigating the problem. It later confirmed that one of its third-party providers had been compromised.

Blockchain security researchers and media reports estimated that the incident caused approximately $2.7 million in losses. The exact figure was not initially confirmed by Polymarket. However, the company acknowledged that users had been affected and promised to make them whole.

The attack reportedly involved a malicious JavaScript file delivered through a website performance-monitoring service. Researchers linked the compromised script to DebugBear, a provider of website monitoring tools. Polymarket’s official incident updates described the supplier as a third-party vendor without initially naming it.

How Hackers Used a Third-Party Script to Target Traders

Modern websites often rely on external scripts for analytics, performance monitoring, customer support, and other functions. These tools help developers understand how visitors use their platforms and identify technical problems. However, a compromised script can create a security weakness if it runs inside the same browser environment as the website.

In this incident, attackers reportedly replaced a legitimate monitoring script with malicious JavaScript. When users visited Polymarket while the compromised code was active, the script could interact with information and trading functions available in their authenticated sessions.

Security researchers examining the malicious code reported that it searched for users’ trading tools and portfolio information. Depending on the account setup, the script could attempt to sell positions or transfer position tokens to an attacker-controlled wallet. This allowed the attackers to misuse access already available inside the logged-in website session.

The method is an example of a supply-chain attack. Instead of attacking every victim individually, criminals compromise a service that trusted websites already use. The malicious code can then reach visitors through the normal website-loading process.

Why the DebugBear Connection Matters

Reports from cybersecurity researchers linked the malicious JavaScript to DebugBear, a website performance-monitoring provider. The service offers tools that help website operators measure loading performance and understand how their pages behave for visitors.

The connection is important because third-party services often receive a level of trust that users do not see. Visitors may recognize the website they are using, but they usually have no idea which external scripts are running in the background. If one of those services becomes compromised, its code may create risks across the websites that load it.

DebugBear reportedly acknowledged that it was affected by a security incident and advised customers using an affected product to remove its embedded code. However, the available reporting did not establish every detail of how the compromise occurred. Polymarket’s official status update confirmed a third-party provider breach, while independent reporting and technical analysis connected the incident to DebugBear.

How Much Money Did Polymarket Traders Lose?

Blockchain security researchers estimated that the attack drained around $2.7 million from affected Polymarket users. GoPlus reportedly placed the losses at approximately $2.71 million, while other investigations identified different amounts associated with suspected attacker wallets.

These figures should be understood as estimates based on blockchain activity and available technical evidence. A wallet balance or transaction total does not automatically represent the final amount lost by individual traders. It is also important to distinguish between funds transferred, assets sold, and the total value of affected positions.

Polymarket later provided a clearer picture of its compensation response. In its incident update, the company said it would return approximately $3.9 million in total. That amount included the reported $2.7 million connected to the attack and an additional $1.2 million intended to cover losses associated with the trading pause.

Polymarket Temporarily Suspended Trading

After identifying unauthorized activity, Polymarket moved its international exchange into a restricted operating mode. It also paused relayer actions to reduce the risk of further unauthorized transactions while the investigation continued.

The temporary suspension was an important containment measure. When a platform suspects that malicious code is interacting with user accounts, allowing normal activity to continue could expose more users or complicate the investigation. Restricting trading gave the team time to remove the compromised component and review the affected environment.

Polymarket subsequently removed the malicious script, cleared its caches, and reset active login sessions. The company also confirmed that it had fixed the issue and restored trading. Its status page marked the incident as resolved after the platform returned to normal operation.

How Polymarket Responded to the Attack

Polymarket announced several measures following the incident. The first priority was removing the compromised vendor script and clearing cached copies so that browsers would no longer receive the malicious version through the website.

The company also reset active sessions to reduce the possibility of continued misuse of existing logins. It said it was introducing additional protections for third-party scripts, including stronger content security policies, version pinning, sandboxing, and continuous monitoring and verification.

These measures are designed to reduce the trust placed in external code. Version pinning can help ensure that a website loads an expected script version, while integrity checks can help detect unexpected changes. Sandboxing and content security policies can also restrict what external scripts are allowed to do.

Polymarket referred the incident to law enforcement and said it would continue investigating the threat actor. The company also indicated that it was working with specialists as part of its response.

Will Affected Polymarket Traders Receive Refunds?

Polymarket publicly stated that affected traders would be compensated. Its October 30 incident update said that approximately 95% of affected wallets had already received full refunds through a combination of returned losses and goodwill payments.

The company described two main areas of compensation. The first covered positions that the malicious script sold or moved during the attack. Polymarket said it would compensate eligible users based on the value of their positions when they were taken, including slippage caused by the forced sales.

The second covered certain losses associated with the trading suspension. If a user’s position lost value because a market ended during the pause, or because the user sold shortly after trading resumed, Polymarket said it would cover the difference based on the position’s value when trading was paused.

The company stated that it used on-chain and trading data to identify eligible wallets, meaning users did not need to submit a claim in every case. Traders who believed their payment was incorrect or missing were directed to contact the company through its published review process.

What This Attack Reveals About Third-Party Website Risks

The Polymarket incident highlights a security issue that affects many online services. Websites depend on external providers to deliver useful features, but each integration can introduce another potential point of failure.

A third-party script may have access to parts of a webpage that users assume are controlled entirely by the main platform. If attackers modify that script, they may be able to perform actions within the website’s browser environment. This can be particularly dangerous for financial platforms where an active session may provide access to trading functions.

The incident also demonstrates why security reviews should cover suppliers, not just a company’s own software. Organizations need to know which external scripts they load, what permissions those scripts receive, and how changes are detected. Reducing unnecessary integrations and limiting script privileges can help reduce exposure.

How Cryptocurrency Traders Can Protect Their Accounts

Users cannot control every third-party service a platform chooses, but they can take practical steps to reduce the risks associated with online trading.

• Review account activity: Check transaction histories, open positions, and wallet activity regularly. Report unfamiliar actions through the platform’s official support channels.
• Use separate wallets: Avoid keeping all cryptocurrency holdings in an account or wallet used for frequent trading.
• Secure login access: Use strong, unique passwords and available authentication protections.
• Check official announcements: Follow the platform’s verified status page and security updates during an incident.
• Revoke unnecessary permissions: Review wallet approvals and remove permissions that are no longer required, using trusted wallet tools.
• Avoid suspicious links: Do not follow refund messages or support links shared through unofficial accounts, emails, or social media posts.

These precautions cannot prevent every supply-chain attack. However, they can help users identify unusual activity sooner and limit the potential impact of a compromised service.

What Happens Next for Polymarket?

Polymarket has restored trading and announced a compensation program, but the incident may influence how the platform manages external software providers. Stronger script controls, continuous verification, and closer supplier monitoring will be important parts of reducing similar risks.

The investigation may also provide more information about how the malicious code reached the website and how the attackers used active trading sessions. Until those details are fully established, some technical aspects and the precise number of affected users remain uncertain.

For the wider cryptocurrency industry, the incident is another reminder that protecting digital assets requires more than securing wallets and smart contracts. Website infrastructure, browser sessions, external scripts, and supplier relationships can all affect user safety.

Conclusion

The Polymarket security incident showed how a compromised third-party script can put cryptocurrency traders at risk. On October 29, 2026, malicious code delivered through an external service reportedly enabled attackers to sell positions and move funds from users’ active sessions. Researchers estimated losses at around $2.7 million, while Polymarket confirmed the vendor compromise and temporarily suspended trading.

The company removed the compromised script, reset sessions, restored the platform, and announced approximately $3.9 million in refunds and related compensation. Although the incident was marked resolved, it highlights the importance of third-party security controls across the cryptocurrency industry. Platforms must carefully monitor every external component that interacts with their users, while traders should continue reviewing account activity and following official security updates.

Frequently Asked Questions

1. What happened to Polymarket traders?

Hackers reportedly used a compromised third-party script to access trading functions in some users’ active sessions. The malicious code could sell positions or move assets to attacker-controlled wallets.

2. How much money was lost in the Polymarket hack?

Blockchain security researchers estimated that approximately $2.7 million was lost. Polymarket later announced a total compensation plan of around $3.9 million, including additional payments related to the trading pause.

3. Was DebugBear involved in the Polymarket incident?

Cybersecurity researchers and media reports linked the malicious script to DebugBear, a website performance-monitoring provider. Polymarket officially confirmed that a third-party vendor had been compromised.

4. Did Polymarket suspend trading after the attack?

Yes. Polymarket temporarily restricted trading and paused relayer actions while investigating the incident. It later removed the compromised script, restored the platform, and marked the incident as resolved.

5. Will Polymarket refund users affected by the hack?

Polymarket said it would compensate affected traders. Its incident update reported that approximately 95% of affected wallets had received full refunds or goodwill payments at the time of the update.

Explore More BTECH WORLD