Polymarket says third-party vendor breach led to theft of more than $2.5 million from users
Polymarket’s international website was hit in the early hours of Oct. 30 Taipei time, after what the company said was a compromise involving a third-party vendor. The platform said it had referred the case to law enforcement and would fully reimburse all affected users. Trading was briefly paused and then restored about an hour later. Loss estimates vary by outlet and analytics provider, but they cluster in the same range. The Wall Street Journal reported that at least $2.6 million in user funds was moved. BleepingComputer estimated roughly $2.57 million, or about 28.6 million POL, while NBC News, citing The Block, said Arkham estimated about $2.65 million. Polymarket has not disclosed the total amount stolen or the number of affected users. The incident appears tied to a security event at DebugBear, a web performance monitoring service. DebugBear told customers using its RUM product to remove embedded code from their sites. Changpeng Zhao, better known as CZ, said the Polymarket case appeared to be a front-end injection attack in which users saw normal trade details but signed altered transactions. BleepingComputer said the malicious JavaScript was built to hijack logged-in sessions, liquidate prediction market positions, and route assets to wallets controlled by the attacker.
