Polymarket Hacked – Users Reported Funds Stolen From Their Wallets

Polymarket suffered a security incident on October 29, 2026, after a compromised third-party provider exposed users of its international platform to wallet theft.

Traders reported missing funds, unexpected withdrawals, and positions being closed without permission. The company temporarily stopped trading, said it had fixed the issue, and promised to reimburse affected users. Trading later resumed.

In its public statement, Polymarket said an outside provider had been compromised and that the matter had been referred to law enforcement. Although early descriptions pointed to an authentication provider, current reporting connects this incident to DebugBear, a website performance monitoring service. Polymarket’s own statement did not name the vendor.

Malicious Script Targeted Active Trading Sessions

Hudson Rock’s technical investigation found malicious JavaScript served through a DebugBear address associated with Polymarket. Instead of simply measuring page performance, the code searched for an active trading session, checked account information, and attempted to use the platform’s existing trading tools to move assets. Researchers downloaded the file twice and received identical copies.

The script read browser storage containing account details, a wallet address, and trading API credentials. It then searched the application’s React components for a live trading client and its signer, the tool used to authorize wallet actions. This approach attempted to reuse access already available inside a logged-in session rather than relying on a stolen password alone.

Its behavior varied by account type. One route attempted to transfer position tokens directly, while another tried to sell positions before moving available funds. Researchers also found code requesting signatures and submitting transactions through Polymarket’s relayer. However, they did not execute the sample, so the findings show intended behavior rather than proof that every attempted transfer succeeded.

According to CNBC’s reporting, analysis from Betting Intelligence and Polysights linked at least $2.7 million in withdrawals to 710 wallets. These figures remain outside estimates, not an officially confirmed loss total. CNBC also reported that Polymarket’s separate United States platform was not compromised.

Polymarket said affected traders would be made whole. CNBC reported that users with less than $10,000 stolen were told their funds would be restored by October 30, while larger claims would require a release form. The reimbursement pledge addresses financial losses, but the exact exposure window and initial method used to compromise the provider remain unresolved.

The incident highlights risks from outside scripts running on sensitive pages. Cybersecurity News previously covered an Adform compromise that distributed crypto-stealing code, showing how trusted infrastructure can become a delivery route.

Its coverage of the compromised XRPL JavaScript package describes a separate supply-chain attack aimed at wallet keys. These cases involve different theft methods, but share dependence on outside code.

Users should close potentially exposed tabs, review recent orders and wallet transactions through trusted channels, and save transaction hashes for support claims. Unexpected signing requests should be rejected. Hudson Rock also recommends reviewing sessions and permissions with official support, avoiding unsolicited recovery links, and never sharing a seed phrase.

Disconnecting a wallet alone does not reverse completed transfers or remove existing blockchain approvals. Users should verify compensation instructions through official channels rather than messages from unfamiliar accounts.

AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?

The post Polymarket Hacked – Users Reported Funds Stolen From Their Wallets appeared first on Cyber Security News.