Polymarket temporarily suspended trading on its international platform on October 29 after a compromised third-party service distributed JavaScript designed to target users’ authenticated trading sessions, cryptocurrency and prediction-market holdings, BleepingComputer reports.
The affected third party was DebugBear, whose Real User Monitoring service provides JavaScript embeds for website performance measurement. BleepingComputer reports that the malicious file was distributed through cdn.debugbear[.]com/C7xcKKrjUnXK.js and could attempt to sell prediction-market positions, transfer tokens and convert cryptocurrency into assets sent to an attacker-controlled wallet. The report identifies the suspected wallet as 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18.
Blockchain activity examined by BleepingComputer showed approximately 28.6 million POL, valued at roughly $2.57 million, transferred from that wallet to three other wallets. That traces assets associated with the suspected wallet, but does not establish the total amount stolen from Polymarket users. Polymarket has not disclosed how many users were affected or how much cryptocurrency was lost.
Polymarket said it identified and fixed the issue, paused trading “out of an abundance of caution,” and later restored trading. The company also said it would fully reimburse affected traders and referred the incident to law enforcement. The Guardian separately reports that Polymarket referred the matter to a law-enforcement agency in the United Kingdom and that the trading pause lasted about an hour in its account of the incident.
For organizations using DebugBear’s RUM product, the immediate provider-level response reported by both accounts is to remove the monitoring embed code. DebugBear said it was investigating an ongoing security incident and advised customers to remove the code, while the available reporting does not establish how broadly other customer websites or users were affected. No CVE, affected software version or complete incident scope has been disclosed in the fetched reports.