Polymarket Suspends Trading After Third‑Party Script Breach Drains $2.5 M in Crypto
What Happened — On 29 Oct 2026 Polymarket, a prediction‑market platform, halted trading after a malicious JavaScript script was injected via a compromised third‑party performance‑monitoring service (DebugBear). The script harvested users’ private keys and transferred roughly 28.6 M POL tokens (≈ $2.57 M) to an attacker‑controlled wallet. Polymarket detected the activity, disabled relayer actions, and entered a cancel‑only mode at 2:05 p.m. ET. The issue was patched by 2:37 p.m., trading resumed an hour later, and the company pledged full reimbursement to affected traders. Law enforcement has been notified, but the exact number of victims and the total crypto stolen remain undisclosed.
Why It Matters for Trust & Control Assurance — The incident underscores the need for continuous oversight of third‑party services that can inject code into user‑facing applications.
Who Is Affected — Crypto‑focused SaaS platforms, prediction‑market operators, and any service that embeds third‑party JavaScript.
Recommended Actions
- Inventory all third‑party scripts and services that run in the client‑side stack.
- Implement a formal third‑party risk management program that includes security questionnaires, continuous monitoring, and contractual security clauses.
- Deploy runtime integrity checks (e.g., Subresource Integrity, CSP) to detect unauthorized script changes.
- Conduct a post‑incident audit to capture evidence of the breach for regulator or auditor review.
Technical Notes
- Attack vector: Compromise of a third‑party Real‑User‑Monitoring (RUM) provider (DebugBear) delivering malicious JavaScript (
cdn.debugbear.com/C7xcKKrjUnXK.js). - Data/asset type: Users’ cryptocurrency private keys and POL tokens.
- Loss: Approximately $2.5 M traced to attacker wallets.
- Discovery: Polymarket’s internal monitoring flagged abnormal token transfers; researchers at Hudson Rock traced the attacker wallet on‑chain.