Polymarket’s international website was attacked in the early hours of Oct. 30 Taipei time. At 02:33, the prediction market platform said on X that one of its third-party vendors had been compromised, that the matter had been handed to law enforcement, and that all affected users would be compensated.
Trading was temporarily paused. Polymarket said at 02:54 that the platform was coming back online, and at 03:00 it said trading had been fully restored.
Reports put stolen funds at more than $2.5 million
The Wall Street Journal reported that at least $2.6 million in user funds had been transferred out. Polymarket has not published the amount stolen or the number of affected users.
NBC News said a Polymarket spokesperson declined to comment on those figures. The same report said the incident did not affect Polymarket’s U.S. platform. Polymarket also said the attack appeared to have come from the United Kingdom and had been referred to U.K. authorities.
DebugBear security incident linked to malicious front-end code
At 02:00 Taipei time, website performance monitoring service DebugBear said it was dealing with an ongoing security incident and asked customers using its RUM product to remove the embedded code from their websites.
Binance founder Changpeng Zhao, or CZ, reposted related information at 02:56 and said Polymarket’s situation appeared connected. He described it as a front-end injection attack: users saw what looked like normal trade details, but the transaction they actually signed had been replaced.
BleepingComputer said the malicious JavaScript was designed to take over logged-in trading sessions, sell users’ prediction market positions, and move crypto and other assets to wallets controlled by the attacker.
Timeline shows heavy wallet activity and emergency changes
According to a timeline compiled by BleepingComputer, a wallet believed to be tied to the attacker carried out heavy trading with the Polymarket token contract between 01:50 and 01:56. At 01:59, one official Polymarket release removed DebugBear code. By 02:05, Polymarket had switched the exchange into a cancel-only mode.
Estimates range from $2.57 million to $2.65 million
Loss estimates are close, but not identical. BleepingComputer, after tracking the attacker’s wallet, estimated losses at about $2.57 million, involving roughly 28.6 million POL. It said the funds were later split across three additional wallets.
NBC News, citing a report from The Block, said blockchain analytics firm Arkham estimated the losses at about $2.65 million.
Polymarket promised full reimbursement; a similar incident happened in June
Polymarket said it would 「fully reimburse all affected traders」. BleepingComputer said the company has not yet explained how that reimbursement process will work.
This was not the first time this year that Polymarket was hit through a third-party vendor. Decrypt reported on June 25 that a third-party vendor had also been compromised in that earlier case, allowing attackers to plant malicious code in Polymarket’s front end. About $3 million in customer funds was stolen then, and Polymarket also promised full refunds.
