Polymarket says it is returning $3.9 million to traders following an attack involving malicious code loaded through a third-party service, SecurityWeek reported on November 2. The payments cover direct theft and losses from unauthorized trades and a trading halt, while website monitoring provider DebugBear has disclosed that attackers compromised its domain records.
Polymarket halted trading on its international platform on October 29 after users reported unauthorized withdrawals. Hudson Rock researchers linked the activity to malicious JavaScript delivered from a DebugBear address that the Polymarket website loaded.
In an October 30 update, Polymarket said 726 wallets were affected. All but 37 had been made whole at that point, with payments to the remaining wallets pending checks of their details. Wallet counts do not necessarily represent individual traders.
The company is also paying $1.19 million across roughly 5,500 wallets to cover traders harmed by the halt or whose positions the malicious script sold or transferred. Combined with roughly $2.7 million stolen directly, Polymarket put the total payout at $3.9 million.
Malicious code used existing trading sessions
Hudson Rock found that the script targeted logged-in traders, checked their portfolios and then either sold positions or moved assets to an attacker-selected wallet. It used the trading permissions already available through the open browser session.
The code also read credential-related data stored in the browser, though Hudson Rock saw no evidence that it sent passwords, seed phrases or private keys to the attacker. The observed mechanism allowed unauthorized trading through an existing session without requiring those secrets to be exported.
Polymarket said it removed the compromised third-party provider within an hour and is investigating with law enforcement. It has promised a postmortem. The company has not named the provider.
DebugBear reports domain-record compromise
DebugBear supplies a real user monitoring script, which websites embed to measure visitors’ page-load performance. The company said attackers compromised its DNS records—the records that direct internet traffic—through its domain registrar, the service used to manage its domain registration. It also said it was unable to receive emails sent to its domain.
DebugBear’s preliminary findings suggest the attackers specifically targeted one customer’s website, but it did not identify that customer. Its investigation into how the attackers obtained registrar-level access remains ongoing; the company said it found no indication that its internal systems were compromised.
Polymarket previously reported a third-party vendor compromise in June that injected a malicious script into its website frontend, with theft reported at around $3 million.
For website operators using DebugBear’s monitoring script, the provider’s initial instruction to customers was to remove the embed code.
