Polymarket has returned $3.9 million to affected traders following a supply chain attack that compromised its international platform. The incident began on October 29 when users reported unauthorized withdrawals from their accounts, prompting an immediate halt to trading on the platform’s international services.
What Happened
After October 29, Polymarket suspended trading on its international platform. Users noticed their portfolios were being altered without consent—positions were either dumped or transferred to wallets controlled by the attacker. These changes occurred silently, with no visible prompts or user notifications.
According to Hudson Rock, a cybersecurity research firm, the malicious activity originated from a JavaScript script served through a DebugBear domain. This script was embedded into Polymarket’s site as part of a performance monitoring integration. The script loaded automatically when users accessed the platform and operated only during active login sessions.
The script accessed user portfolios and either dumped positions or transferred assets to a wallet selected by the attacker. It read data stored in browser sessions, such as trading permissions, but did not retrieve passwords, seed phrases, or private keys. Hudson Rock stated that the script did not attempt to extract sensitive credentials, instead leveraging the existing permissions granted by a logged-in session.
Key Facts
- 726 wallets were affected by the attack.
- All but 37 wallets had been reimbursed by October 30.
- Polymarket paid $1.19 million to traders whose positions were sold or transferred by the script.
- Approximately $2.7 million was stolen directly from user accounts.
- Total payout to users: $3.9 million.
- Polymarket removed the compromised third-party provider within one hour of detection.
Polymarket said it is working with law enforcement and will release a full postmortem report detailing the technical chain of events and remediation steps.
DebugBear’s Disclosure
DebugBear, a website performance monitoring service, said its DNS records were compromised through its domain registrar. The company confirmed it currently cannot receive emails sent to its domain, which has disrupted its ability to communicate with clients and respond to alerts.
DebugBear reported that the attack targeted one customer’s website, though it emphasized this is a preliminary finding. It did not name the customer, and Polymarket has not disclosed the identity of the compromised provider. This lack of transparency raises concerns about the visibility of third-party risks in digital ecosystems.
DebugBear has not explained how attackers gained access at the registrar level. While it found no evidence that its internal systems were compromised, the breach at the registrar level suggests a vulnerability in domain management infrastructure. The company is actively investigating the incident and has not yet published a detailed technical analysis.
Background: How the Attack Worked
Polymarket uses third-party services to enhance its functionality. In this case, a script from DebugBear was embedded into the site to monitor page load performance and user engagement. These scripts are typically designed to run in the background and collect performance metrics without user interaction.
When a user logs in, the browser session grants access to trading functions. The malicious script exploited that access to modify portfolio data. It did not require users to enter credentials or interact with any form of authentication. Instead, it operated within the scope of an active session, using permissions already granted by the user’s login.
There is no evidence the script transmitted sensitive data like private keys or seed phrases back to the attacker. However, the ability to alter portfolio balances without user consent demonstrates a critical flaw: session-based permissions can be exploited to perform unauthorized actions.
Why It Matters
This incident highlights the vulnerabilities inherent in supply chain dependencies. A single compromised third-party provider can affect multiple platforms, especially those with public-facing interfaces and embedded scripts.
It underscores the importance of rigorous vetting and real-time monitoring of third-party scripts before embedding them into public-facing sites. Organizations must evaluate not only the functionality of such tools but also their security posture and access controls.
Users may not always recognize when a script is running in the background. This raises awareness about session-based permissions and their risks. Even if a script does not extract passwords, it can still manipulate financial data under the guise of legitimate user activity.
Limitations and Open Questions
There is no public confirmation of which specific third-party provider was compromised. Polymarket has not named the provider, leaving uncertainty about the scope of the vulnerability.
DebugBear has not detailed how the registrar was breached. No evidence suggests internal systems were compromised, but the breach at the registrar level points to a potential gap in domain security practices.
It remains unclear whether the attack was isolated to one customer or part of a broader campaign. The lack of public details about the target website or the attacker’s motives makes it difficult to assess the full scale of the incident.
While the script did not steal private keys, it still allowed unauthorized asset transfers. This shows that session-level access can be exploited, even without direct credential theft.
What to Watch Next
Polymarket will release a detailed postmortem report. This will likely include technical findings, such as the exact code segments involved, how the script was executed, and the timeline of detection and response.
DebugBear is expected to publish a full investigation into how its DNS records were compromised. This could provide insight into how domain registrars are vulnerable to attacks and what safeguards are needed.
Security experts will likely assess whether similar vulnerabilities exist in other platforms using third-party monitoring tools. The incident may prompt broader industry reviews of third-party integrations and their security controls.
Regulatory bodies may review how such incidents are reported and managed in real time. As financial platforms increasingly rely on third-party services, the need for standardized incident disclosure and risk mitigation protocols becomes more pressing.
Polymarket faced a similar incident in June, when a third-party vendor compromise led to a malicious script being injected into its frontend. The theft was reported at around $3 million. That prior incident also involved a malicious script injected into the frontend, showing a recurring pattern of supply chain risks.
For more on cybersecurity developments, see the original report at SecurityWeek.
Sources & further reading
Featured image: Polymarket hacked. Via original publisher. Image source
