Polymarket Restores Trading After Cyberattack Drains $2.7 Million From Users

Polymarket users lost an estimated $2.7 million in a cyberattack linked to a third-party technology provider, leading the prediction market to briefly pause trading on Thursday. The platform has now brought trading back and promised to pay back all users who lost money.

What Happened

Traders first reported unauthorized withdrawals from their accounts on Thursday. Polymarket found the security flaw, fixed it, and reported the issue to law enforcement. The company originally switched its exchange to a cancel-only setting, which let users cancel open orders but stopped them from placing new ones. Relayer operations were also paused. An official close to the matter and the Wall Street Journal identified DebugBear as the third-party provider involved. DebugBear is a website performance monitoring company based in the UK. DebugBear confirmed it faced a security incident and advised users of its Real User Monitoring product to remove embedded code from their websites. Researchers at Hudson Rock stated that a script from DebugBear had code designed to spot active user sessions, drain holdings, and send funds to another wallet. Blockchain analysis showed a wallet receiving over $2.5 million from users across more than 900 transactions, holding roughly $2.65 million in POL tokens according to Arkham data cited by Decrypt. DeFi Llama estimated total losses at about $2.7 million.

Context

Cryptocurrency and prediction platforms often rely on external software vendors to manage website performance and user tools, which can create extra security risks if a vendor is compromised. Polymarket has faced previous security issues, including a May incident where attackers took about $700,000 from an internal top-up wallet and a June attack that drained roughly $3 million from fewer than 15 accounts via a compromised vendor. Third-party supply chain attacks remain a major challenge for digital asset platforms globally.