ReportedUpdated 3 Nov 2026
Polymarket Hack
What happened
Polymarket halted trading on its international platform on October 29 after users reported unauthorized withdrawals.
Reported impact
An affected population has not been established in the accepted evidence.
- Attack method
- supply chain compromise of DebugBear’s RUM script
- Attack method
- malicious JavaScript code
Source evidence
1Read the original reporting and statements. Multiple articles may rely on the same underlying source.
SecurityWeek01$2 Million+ Drained From Polymarket Traders in New Supply Chain Attack - SecurityWeek
Published 30 Oct 2026Retrieved 3 Nov 2026
“We’ve identified & fixed an issue impacting our international platform, Polymarket.com. One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement. Anyone who has been impacted will be made whole,”
Attributed reporting
2 more excerpts
Researchers have linked the theft to malicious code served from DebugBear, a UK-based website performance monitoring firm.
Attributed reporting
The code hunted for a logged-in user’s trading tools and portfolio.
Attributed reporting
Updates and corrections
- Revision 1
Incident updated.