Polymarket suspended trading for about an hour after at least $2.6 million belonging to its users was misappropriated. The attack would not have targeted the blockchain itself, but a performance measurement tool integrated into the site, revealing an often overlooked weakness of non-custodial platforms.
In brief
- Polymarket suspended trading for an hour after an estimated $2.6 million hack.
- More than 700 accounts were reportedly affected, with positions sold and funds transferred without authorization.
- The attack reportedly exploited a compromised external script, without directly affecting the Polygon blockchain.
- Polymarket promises to fully reimburse users who are victims of the hack.
- A similar incident had already caused around $3 million in losses in June.
A simple tracking script opened access to the accounts
The incident began on October 29 on the international platform Polymarket.com. Users have reported selling their positions and transferring their assets without authorization. One of them claimed to have lost $800,000, while another account was allegedly emptied of $600,000.
Polymarket first switched its market to mode “cancel-only”. Traders could cancel their existing orders, but could no longer place new trades. The actions of the service responsible for transmitting signed transactions to the blockchain have also been suspended.
THE information available allow us to reconstruct the main stages of the incident:
- A third-party solution integrated into the site was compromised;
- Malicious JavaScript code would have targeted sessions already connected;
- Some users’ positions were sold without their consent;
- The obtained assets were then sent to an address controlled by the attacker;
- More than 700 accounts would have been affected, for at least $2.6 million;
- Polymarket promises to fully reimburse victims.
The interruption lasted an hour. The platform then announcement have corrected the problem and restored all of its services. She assured, while specifying that she had transmitted the file to the British authorities:
Anyone affected will be fully compensated.
However, the final amount has not yet been communicated. Estimates are primarily based on observed movements to an address assigned to the attacker. The exact number of victims and the terms of reimbursement also remain to be specified.
The blockchain was intact, but the Polymarket interface was no longer intact
The first on-chain analyzes point to DebugBear, a British company specializing in monitoring website performance. Its Real User Monitoring service relies on a script integrated into its clients’ pages in order to measure loading times and visitor experience.
After this infrastructure was compromised, the legitimate script would have been replaced or modified to incorporate malicious code. This checked whether the visitor was connected to Polymarket, then sought to use their active session to sell their positions and transfer their assets.
Hudson Rock researchers identified in this code an address serving as the recipient of the funds. Blockchain analysis shows that 28.6 million POL tokens, valued at approximately $2.57 million, were then distributed among multiple wallets.
DebugBear has recognized be confronted with “an ongoing security incident” and asked its customers to remove its embedded code. This mechanic provides an essential nuance. The attacker would not have broken Polygon, falsified an on-chain transaction or compromised the central contract of the predictive market. He would have hijacked the web layer used to prepare and authorize operations.
A platform can therefore remain technically non-custodial while exposing its users through its interface. When the browser loads an external component, that provider indirectly inherits a position of trust. If compromised, the code displayed on the screen can become more dangerous than a flaw in the protocol itself.
Two similar attacks expose structural risk
The episode is all the more worrying because it does not constitute an isolated case. In June, the compromise of another service provider had already allowed the injection of malicious code into the Polymarket interface. Around $3 million was then stolen from less than fifteen accounts.
Combining the two incidents, nearly $5.6 million was allegedly embezzled in a few months through third-party suppliers. The repetition shifts the debate: the problem is no longer just a faulty service provider, but the way Polymarket controls the scripts executed on its site.
The promise of reimbursement limits direct financial loss for traders, without eliminating operational risk. A position sold during a volatile market cannot always be reconstructed identically. Compensation will therefore have to determine whether it covers only the misappropriated funds or also the value of positions closed against the wishes of the users.
The incident finally reminds us that a personal wallet does not protect against all scenarios. A connected session, a still valid authorization or a signature obtained by a compromised interface may be sufficient. For Polymarket, the real challenge now consists of reducing external dependencies and preventing a secondary tool from being able to order financial operations again.
Maximize your Tremplin.io experience with our ‘Read to Earn’ program! For every article you read, earn points and access exclusive rewards. Sign up now and start earning benefits.
