AnswersPublished22 sources
How a Compromised Monitoring Script Drained Polymarket Traders’ Accounts
On October 29, 2026, malicious code delivered through a compromised monitoring script used logged in sessions to drain an estimated $2.7 million from Polymarket’s international platform.
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- On October 29, 2026, malicious code delivered through a compromised monitoring script used logged in sessions to drain an estimated $2.7 million from Polymarket’s international platform.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What happened in the October 29 hack of Polymarket’s international platform, including the suspected compromise of UK monitoring provider De. Article summary: The October 29, 2026 incident appears to have been a browser-side supply-chain attack on Polymarket’s international website: malicious third-party monitoring code abused logged-in trading sessions, rather than exploiting. Topic tags: general, news, general web, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts w
Polymarket’s October 29, 2026 security incident was a browser-side supply-chain attack: malicious code delivered through a compromised third-party monitoring script took advantage of logged-in trading sessions on the international platform. The incident did not require attackers to break Polymarket’s smart contracts. Estimates put the stolen funds at roughly $2.5 million to $2.7 million, and trading was halted for about an hour. 2
6
15
How the attack worked
Polymarket said a third-party provider had been compromised. Researchers and subsequent reporting linked the malicious script to DebugBear, a UK-based website performance and monitoring provider; the company’s initial statement, as reported, did not name the provider. 2
29
The reported attack path was through the website, not a flaw in the platform’s underlying smart contracts. Analysis of the JavaScript said it looked for a logged-in user’s trading client and portfolio, then attempted to sell or transfer assets using the active session. 3
15 In other words, the code abused access available in a user’s open browser session rather than directly breaking the contracts.
2
22
Trading paused for about an hour
Polymarket put its international exchange into a restricted state while it investigated, including cancel-only mode and a pause to relayer actions. Its status page records the outage from 6:05 to 7:05 p.m. UTC on October 29—2:05 to 3:05 p.m. ET—and says trading would resume at about 3 p.m. ET. The company later marked the incident resolved. 41
The incident affected the international site, Polymarket.com. Some reporting said the separate U.S. platform was unaffected, but the available company status update is focused on the international platform and does not independently confirm that distinction. 24
29
What was stolen—and what the tracing shows
Reports put the loss at roughly $2.5 million to $2.7 million. These figures are estimates, and sources describe different parts of the incident: BleepingComputer traced approximately $2.5 million in assets to a suspected attacker wallet, while other reports put total losses closer to $2.7 million. 4
6
Blockchain reporting tracked about 28.6 million POL associated with the suspected attacker’s wallets, valued at roughly $2.57 million in BleepingComputer’s account. That trace is evidence about funds visible on-chain, not by itself a definitive accounting of every user’s loss. 6
Repayments and what remains unclear
By Friday morning, October 30, Polymarket reported that 689 of 726 affected wallets had been fully repaid, with the remaining 37 awaiting verification. 22 The company’s reported $3.9 million reimbursement total included a separate $1.19 million allocation for about 5,500 wallets affected by trading disruption or positions taken during the incident, according to reporting that relayed the platform’s update.
23
Some secondary coverage reported that users with losses above $10,000 faced a release-form requirement. The material available here does not establish the exact terms or substantiate claims about identity checks or non-disparagement clauses, so those details should be treated as unconfirmed. 24
46
The security lesson: third-party code can inherit a site’s trust
A monitoring script may serve a legitimate operational purpose, but code loaded into a trading site can become a security risk if it can interact with authenticated functionality. In this incident, the reported attack used the browser session of users who had the site open. 3
22
One possible safeguard is Subresource Integrity (SRI), which lets a browser check an external script against a trusted hash and reject it if the file has changed. That protection would help only if it were correctly applied to the compromised script-loading path; it is not a guarantee against every third-party or site compromise. 44
Polymarket’s status page later published a detailed update describing the incident and the company’s response. 29 The available reports establish the broad attack path, approximate losses and reimbursement progress, but leave some legal terms and the full scope of affected services unresolved.
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "How a Compromised Monitoring Script Drained Polymarket Traders’ Accounts"?
On October 29, 2026, malicious code delivered through a compromised monitoring script used logged in sessions to drain an estimated $2.7 million from Polymarket’s international platform.
Sources
gamingamerica.comIs Polymarket Safe? $2.7 Million Hack Exposes Weak Tech Stac
bleepingcomputer.comPolymarket halts trading after crypto-draining script breach ...
securityweek.com$2 Million+ Drained From Polymarket Traders in New ...
status.polymarket.comSecurity incident - 3rd party vendor compromised - Incident details - Polymarket - Status