Polymarket (international platform) third-party script exploit: Polymarket halts trading, then resumes, after third-party script compromise drains ~$2.65M from users
On 2026-10-29 Polymarket paused trading on its international platform after users reported drained balances. The company said a third-party provider had been compromised. Security analysis points to malicious JavaScript that hijacked logged-in user sessions, not a smart-contract flaw. Reported losses are about $2.65M, and Polymarket resumed trading the same day and promised to make affected users whole.
What happened
On October 29, 2026, users of Polymarket's international platform posted on X that their balances had been drained without authorization. CoinDesk reportedly confirmed that some users saw balances drained. Polymarket paused trading, reportedly moving to cancel-only mode, while it investigated.
Polymarket said a third-party provider had been compromised and that it had fixed the issue on its end. It reopened trading around 3 p.m. ET the same day, according to coverage cited in the research. It also said it referred the matter to law enforcement. CNBC reportedly said the referral was to U.K. authorities.
Reported losses are about $2.65M. Some outlets say more than $2.5M, and FinanceFeeds says about $2.7M from more than 700 accounts, a figure the research treats as approximate. The Wall Street Journal reportedly said the funds moved in more than 900 transactions.
On reimbursement, Polymarket said affected users would be 'made whole'. CNBC reportedly said users who lost under $10,000 would be restored by Oct. 30, while larger losses would require a release form.
How it worked
Per Security Boulevard's technical analysis and BleepingComputer, malicious JavaScript was served through a third-party vendor script on Polymarket's site. Some coverage names a monitoring provider, DebugBear, as the suspected source, reportedly without independent confirmation. The code appears to have targeted authenticated trading sessions rather than Polymarket's core smart contracts. It is described as a front-end or supply-chain compromise.
Once a user's session was active, the script reportedly could read balances and act through Polymarket's normal trading and withdrawal paths. The analysis describes several routes: building signed transaction batches through Polymarket's relayer, approving and swapping collateral, selling positions at aggressive prices and withdrawing the proceeds, or moving outcome-token balances from the user's deposit wallet to the attacker with ERC-1155 batch transfers. Reporting says the attacker address was hard-coded as a fallback recipient in the malicious script.
Timeline
- 2026-10-29Users report drained balances on X; Polymarket suspends trading on its international platform (reportedly cancel-only mode).
- 2026-10-29Polymarket says a third-party provider was compromised and that it fixed the issue on its end. CoinDesk reportedly confirms some users' balances were drained.
- 2026-10-29Trading resumes around 3 p.m. ET (per reports). Polymarket says affected users will be made whole and that it has referred the matter to law enforcement.
- 2026-10-29Security analysis published describing the malicious JavaScript session-hijack; BleepingComputer reports on-chain tracing of the funds.
- 2026-10-30Per CNBC, users with losses under $10,000 are due to be restored by this date; larger losses require a release form. FinanceFeeds reports about $2.7M lost across 700+ accounts.
Where the money went
Per reporting by Hudson Rock, Arkham-traced coverage and BleepingComputer, the drained USDC.e/USDC was swapped into roughly $2.57M-$2.65M of POL through Relay. BleepingComputer reportedly said the wallet then moved about 28.6M POL (about $2.57M) into three additional wallets. The research found no documented use of mixers, bridges or exchange deposits beyond the Relay swaps and the follow-on wallets. No verified report of an on-chain freeze or official recovery of attacker funds was found.
Wallets linked to this case
| Address | Chain | Role | Source |
|---|---|---|---|
0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18 | Polygon (reportedly) | attacker (suspected; most-cited drain and swap wallet, repor | source |
Every address is from a public source. Check any wallet in the dirty wallet checker.
The response
Polymarket paused trading quickly, said a third-party provider was compromised, and reopened the same day after fixing its side. It said it referred the matter to law enforcement and pledged to make affected users whole. Per CNBC, losses under $10,000 would be restored by Oct. 30, and larger ones need a release form. The company did not name the vendor or an attacker in its statement, and the research does not show a regulator action.
Market and user impact
Trading on the international platform was briefly halted, and the research shows no clear sustained price shock across Polymarket markets. Users reported unauthorized drains, with about 700+ accounts reportedly affected (approximate). The reimbursement pledge reportedly eased some of the immediate panic.
What people say
60% negative · 15% positive · the rest neutral · themes: third-party/supply-chain risk, drained user balances, reimbursement promised, fast resumption of trading, release-form condition for larger losses
How to protect yourself
- Users: treat any site that loads third-party scripts as a risk. Use a separate wallet with limited funds for trading, and review and revoke token approvals regularly.
- Users: if you see unexpected transactions, stop trading and check on-chain activity. Be careful with any release form and confirm it comes from official channels.
- Builders: vendor and monitoring scripts running in authenticated sessions are a high-value target. Use Subresource Integrity, a strict Content Security Policy, and script isolation or sandboxing on pages that handle signing or withdrawals.
- Builders: add withdrawal safeguards such as allowlisted addresses, anomaly detection and delays on large or unusual transfers, so a hijacked session cannot drain funds quickly.
Still unknown
- Whether DebugBear was the compromised provider; this is reported but not independently confirmed.
- Who is behind the attack, and how the vendor was compromised.
- The exact total loss and number of affected accounts, which differ across outlets ($2.5M-$2.7M; 700+ accounts).
- The full list of affected assets and chains.
- Whether any attacker funds have been frozen or recovered.
- Final reimbursement completion and the terms of the release form for larger losses.
Sources
- NBC News - Polymarket trading halt, hack, wallets
- CoinDesk - Polymarket suspends trading after third-party breach leads to user losses
- BleepingComputer - Polymarket halts trading after crypto-draining script breach
- CNBC - Polymarket reports outage on international exchange, halts trading
- Wall Street Journal - Polymarket pauses trading after some users report funds drained
- Bloomberg - Polymarket halts trading after reports of customers losing money
- The Block - Polymarket exploit, cancel-only mode
- Unchained - Polymarket resumes trading, vows to reimburse traders
- Security Boulevard - Dissecting the Polymarket malicious JavaScript exploit
- FinanceFeeds - Polymarket restores trading after hack drains est. $2.7M from 700+ accounts
- Ababnews - wallet and fund-flow reporting
- Crypto Economy - Polymarket restores trading after $2.65M exploit
- Washington Examiner - Polymarket UK platform, DebugBear hacked
- BNO News: Some Polymarket users report losing funds after security breach
- FinanceFeeds: Polymarket restores trading after $2.65M drain
- Bitcoin.com News: Polymarket halts trading, exploit stole estimated $2.7M
How we report: Sentinel reads news, investigators' posts, company statements and on-chain data, attributes every claim to its source and marks unconfirmed numbers as reported. Severity measures size and systemic risk; the response score measures how fast and transparently users were protected. Not financial advice and not a finding of guilt. Corrections: contact us.
VaultX