On October 29, Polymarket faced a major security breach when malicious code entered its website through a third-party monitoring script provided by DebugBear. According to reports, the hack took advantage of active user sessions to sell positions and take out almost $2.6 million in POL tokens from about 700 wallets in less than an hour.

The platform ceased trading and started addressing the issue after confirming the vendor-related breach. It also promised to fully refund impacted users and forwarded the issue to UK law authorities.

Malicious DebugBear Script Exploits Logged In Polymarket Sessions

A compromised third-party script connected to DebugBear, Polymarket's website monitoring service, was the source of the October 29 incident. Users who were already logged in were the target of malicious code that was introduced into the script and made its way to the platform's interface.

The attackers took advantage of the hacked website interface and active user sessions instead of targeting Polymarket's underlying smart contracts. They were able to sell users' current holdings, withdraw POL tokens, and communicate with affected accounts.

The attackers apparently moved over $2.6 million in assets in an hour, affecting almost 700 wallets. Users had limited opportunity to spot suspicious behaviour and defend their positions due to the operation's pace.

The incident highlights how an external service integrated into a website can become an entry point for attackers, even when the platform's core blockchain infrastructure remains unaffected.

Polymarket Halts Trading & Promises Full Reimbursements

Following the discovery of the breach, Polymarket momentarily stopped trading while its employees looked into the suspicious activity and put its global platform in cancel-only mode. In order to stop more illegal transactions, the business also stopped relayer activities.

Polymarket acknowledged that it had located the problem, resolved it, and reported it to UK law enforcement authorities. After about an hour, it resumed trading and declared that all affected traders would be fully compensated.

The estimated 700 affected wallets and the claimed $2.6 million loss have not been independently verified by the company. Rather than an official Polymarket breakdown, those numbers are based on blockchain tracking and security research. On October 29, it was verified that trading would be suspended, restored, and reimbursed.

We've identified & fixed an issue impacting our international platform, Polymarket⁠.com. One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement.

Anyone who has been impacted will be made whole.

Out of an abundance of caution, we have temporarily halted trading & are working to bring the platform back online.

— Polymarket Traders (@PolymarketTrade) October 29, 2026

Attack Leaves Smart Contracts Untouched but Exposes Frontend Risks

There was no known issue in Polymarket's primary smart contracts. Rather, the website's external monitoring service was used by the attackers to spread malicious JavaScript.

This distinction is important because the malicious script may run in a browser session that has already been authenticated. It didn't always have to steal a user's private key or recovery phrase. It could try to sell positions and transfer assets by abusing the permissions and features offered by the logged-in interface.

Customers utilising DebugBear's Real User Monitoring solution were advised to remove the embedded code from their websites after the company confirmed an ongoing security incident. Since the compromised script was disseminated through an outside vendor rather than Polymarket's own smart contract infrastructure, this response is also important for other companies utilising the service.

Polymarket's record for 2026 now includes another security issue from the October 29 breach. Multimillion-dollar losses were also disclosed from a different frontend risk in June. The most recent occurrence highlights the need for systems that handle users' financial assets to incorporate external monitoring services.

If you find any issues in this article or notice missing information, please feel free to reach out at team@etherworld.co for clarifications or updates.

To promote your Web3 articles, events, and projects, you may reach out anytime via EtherWorld PR for submissions and collaboration.

Related Articles

1. Meta Launches Stablecoin Creator Payouts on Polygon
2. Polygon Crosses $200M in Intent-Driven Payment Volume
3. Polygon Introduces sPOL to Unlock Staked Liquidity
4. Polygon Records 625M Stablecoin Transactions Surge
5. Polygon's Stablecoin Activity Soars to New Highs in 2026

To follow blockchain news, track Ethereum protocol progress, and read our latest stories, subscribe to our weekly today.

Join the EtherWorld & Avarch Internship Program and build your career in blockchain, content, social media, video, podcast editing, or operations. Send your resume and brief introduction to contact@etherworld.co.