Prediction market Polymarket took its platform offline on 30 October after a cybersecurity incident at an unnamed third-party provider, saying it identified and fixed the issue, referred the matter to law enforcement and would reimburse affected traders. Blockchain analysts traced more than US$2.1 million in cryptocurrency drained from user wallets to a single account, with BleepingComputer later reporting roughly US$2.5 million traced overall. Security firm Hudson Rock identified the provider as DebugBear, a website-performance vendor, finding "wallet-draining code" in a third-party script that could discover accounts, select assets and transfer funds; DebugBear confirmed an "ongoing security incident" and urged customers to remove its embed codes. Trading has since resumed. The incident highlights how code loaded from unvetted third-party providers can reach customer funds, and it follows the identically-shaped supply-chain incidents of recent weeks against crypto platforms.
| Attribute | Detail |
|---|---|
| Sector | Financial Services |
| Date | 2026-10-31 |
| Source | The Record |
| Reliability | Tier 2 |
| Breach classification | Confirmed breach |
Escalation — Polymarket to refund $2.7 million after DebugBear script hijack; registrar DNS takeover named as cause (2026-11-02)
Malicious code on prediction-market Polymarket's website sold some signed-in traders' positions and moved the funds to attackers on 29 October. Polymarket says it is refunding about US$2.7 million to 726 affected wallets, with blockchain records showing roughly US$2.64 million reaching the attackers' wallet in under an hour. The replacement code had swapped a page-speed script the site loaded from outside vendor DebugBear, whose real-user-monitoring tool measures how fast pages load for visitors; each customer loads its own copy, and the file swapped was Polymarket's. DebugBear said its DNS records were compromised through its domain registrar, that its early findings indicate the attack targeted one customer's website, and that it has seen no sign of a break-in to its own systems. Hudson Rock downloaded the malicious file on 29 October, and Ohey researchers found a different server answering for DebugBear's web addresses at 18:13 UTC that day. The incident sharpens the third-party-script risk already flagged in the sector this week.