Polymarket Resumes Trading After $2.6M Third-Party Supply Chain Attack
A compromised performance monitoring script allowed attackers to drain 995 user accounts.
1Platform Security Breach Overview
On October 29, 2026, Polymarket suspended trading operations following a significant security incident. Attackers exploited a vulnerability in a third-party service, leading to the unauthorized drainage of approximately $2.65 million from user accounts. The platform quickly transitioned to a cancel-only mode to prevent further losses while investigating the root cause.
2The DebugBear Vulnerability Mechanism
The breach originated from a compromised script provided by DebugBear, a performance monitoring tool integrated into the Polymarket website. Malicious code injected into this script accessed active user sessions. By hijacking these sessions, attackers systematically liquidated open positions at sub-market prices, converting the resulting balances into POL tokens for immediate withdrawal.
3Impact on User Accounts
According to crypto investor Evan Luthra, the attack compromised 995 individual user accounts. Victims reported substantial losses, with some traders losing up to $800,000 in a single event. The attackers utilized DebugBear’s data endpoints to exfiltrate sensitive information, including wallet details, portfolio sizes, and user locations, throughout the duration of the exploit.
4On-Chain Asset Movement
On-chain analysis confirmed that the attacker’s wallet balance reached approximately $2.65 million in POL tokens within 45 minutes. These assets were subsequently moved across multiple addresses to obfuscate the trail. DebugBear acknowledged the security incident on their end and advised all clients to immediately remove the affected code from their respective websites.
5Polymarket Response and Compensation
Polymarket officially confirmed the identification and resolution of the issue after working with relevant law enforcement agencies. The company issued a public commitment to fully compensate all affected traders for their losses. Trading services were resumed once the platform verified that the malicious script had been successfully purged from their infrastructure.
6Recurring Security Challenges
This incident marks the third major security challenge for Polymarket in 2026. Previous events included a suspected compromise of the platform's deployer address in May and a $3.1 million phishing attack in June involving EIP-7702. These repeated vulnerabilities highlight the persistent risks associated with third-party dependencies in decentralized finance platforms.
7Supply Chain Risk Reality
The attack underscores a critical vulnerability: even when smart contracts remain secure, external scripts can bypass established defenses. By embedding performance trackers directly into the user interface, platforms inadvertently create high-value targets. This event serves as a stark reminder that frontend security is as vital as backend blockchain integrity for users.
8Broader Industry Security Context
The crypto industry continues to face significant financial threats, with hackers stealing billions in assets throughout 2025 and 2026. As platforms increasingly rely on third-party integrations for analytics and performance, the attack surface expands significantly. Future security strategies must prioritize rigorous vetting and sandboxing of all external scripts to protect user funds.
Original article: INCRYPTED — Polymarket Resumes Trading After $2.6M Third-Party Supply Chain Attack