Breach · · 3 min read
Polymarket traders lost funds after a website monitoring script was hijacked
Attackers hijacked a performance-monitoring script on Polymarket’s international site and used signed-in sessions to drain users’ funds. Polymarket says it will reimburse them.
Polymarket, a prediction market where people bet on real-world events using cryptocurrency, briefly stopped trading on its international site after attackers used a third-party script to drain some users’ funds. Polymarket says everyone affected will be made whole. If you use Polymarket or any crypto app in your browser, here’s what happened and what’s worth knowing.
What happened
On the afternoon of October 29, 2026 (US Eastern time), Polymarket said one of its third-party providers had been compromised. It put its international exchange, Polymarket.com, into cancel-only mode, fixed the issue and resumed trading about an hour later, BleepingComputer reported. Polymarket said: “Anyone who has been impacted will be made whole.”
According to Hudson Rock and BleepingComputer, the script came from DebugBear, a service that measures how fast websites load using a small piece of JavaScript embedded in the page. Researchers at Hudson Rock found malicious JavaScript served from DebugBear’s servers that, according to BleepingComputer’s analysis, used visitors’ signed-in Polymarket sessions to sell their positions or move their tokens and crypto to an attacker’s wallet. DebugBear said on X that it was dealing with a security incident and told customers of its monitoring product to remove its code from their sites.
How much was taken isn’t confirmed by Polymarket. BleepingComputer traced about $2.5 million (US) moving out of a wallet named in the script. Two analytics firms told CNBC that one account withdrew at least $2.7 million across 710 wallets. CNBC reports that Polymarket’s US platform wasn’t affected and that Polymarket told users on Discord that people who lost less than $10,000 would have their funds restored by October 30, while larger amounts require signing a release form first.
There’s no report so far of personal details like names or emails being taken. This was about funds moved from signed-in sessions.
What this means for you
Websites load code from many outside services: analytics, chat widgets, performance tools. If one of those services is broken into, its code runs on every site that uses it, with the same access you have when you’re signed in. You couldn’t have spotted this one from the page. A similar shared-script attack hit Brazilian online stores through Convertr this week.
What you can do
- Check your Polymarket activity. Look for trades, sales or transfers you didn’t make on or around October 29.
- Follow Polymarket’s reimbursement steps from its own site, app or official Discord. Be wary of anyone who messages you first offering to help recover funds; refund scams usually follow incidents like this one.
- Never share your wallet’s recovery phrase. No real support team will ever ask for it.
- Sign out of trading sites when you’re done. This attack worked through sessions that were already signed in.
How Frame helps
Frame can’t see into crypto wallets or stop a script on another company’s site. What it can do is help with what comes after an incident like this: Frame’s email aliases let you give each financial app its own address, so a “refund” email that arrives at the wrong address is an easy sign of a fake. Frame never collects or stores leaked records.
Sources
- BleepingComputer, Polymarket halts trading after crypto-draining script breach, $2.5M traced, October 29, 2026
- CNBC, Some Polymarket user funds stolen by hackers; exchange referring matter to U.K. authorities, October 29, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.