Attack Exploits Third-Party Monitoring Tool
Polymarket suspended trading on its international platform for one hour on October 29 after a cyberattack resulted in the theft of approximately $2.7 million from user wallets. The incident targeted the crypto-based exchange at Polymarket.com, distinct from the platform’s U.S.-facing operations.
The breach was facilitated through DebugBear, a third-party performance monitoring tool embedded in the website’s code. Hackers tampered with the JavaScript hosted on DebugBear to exploit existing logged-in sessions. By manipulating this script, attackers accessed customers’ wallets without requiring users to click phishing links or leak passwords. The stolen assets were subsequently sold or transferred to wallets controlled by the attackers.
Blockchain Analytics Firms Report Varying Losses
Blockchain analytics firms have provided differing estimates regarding the scale of the breach. Bubblemaps reported that the attack affected 700 users on the international platform. Bitquery provided a slightly higher estimate, citing 737 affected users and a total stolen sum of $2.73 million.
Cybersecurity firm BleepingComputer traced roughly $2.57 million in Polygon’s proprietary POL cryptocurrency from a suspected attacker’s wallet. Polymarket has not officially confirmed the total number of affected customers or the precise amount of funds lost, though the company acknowledged the attack and promised reimbursement to affected players.
Regulatory Orders and Security Response
In response to the security failure, Polymarket referred the incident to UK law enforcement. DebugBear acknowledged the incident and requested that clients using its Real User Monitoring software remove the embedded code from their websites.
Separately from the cyberattack, the Michigan Gaming Control Board ordered Polymarket to exit the Michigan market by November 25, 2026. This regulatory directive is distinct from the cybersecurity incident but represents a significant operational constraint for the platform in the U.S. market.
The trading pause lasted for one hour, during which time the platform worked to mitigate the active threat. Users on the international platform could lose money through the compromised script without any traditional security breach, such as a password compromise. The incident underscores the vulnerabilities present in relying on third-party scripts for web performance and security, as the attack leveraged trusted external code to bypass standard user authentication safeguards.
Polymarket has not announced a timeline for fully restoring all services or the completion of its reimbursement process. The company continues to coordinate with law enforcement and technical partners to secure its infrastructure. For the 700 to 737 affected users, the immediate financial loss has been offset by the company’s promise of reimbursement, though the broader implications for user trust and platform security remain under review.
Why It Matters
The compromise of a third-party monitoring tool demonstrates how external scripts can bypass standard user authentication, exposing iGaming operators to significant financial and reputational risk. The varying loss estimates from blockchain analytics firms highlight the difficulty in quantifying immediate damage during an active cyber incident. Additionally, the Michigan Gaming Control Board’s order to exit the state market by November 25, 2026, signals a tightening regulatory environment for prediction market platforms operating in the U.S.
Karine Gomez is an enthusiastic writer and avid gamer with a particular love for PlayStation and casino gaming. Her deep knowledge of gaming trends and casino dynamics makes her articles both informative and engaging. Karine’s passion for PlayStation games and her firsthand experience with casino play shine through in her writing, offering readers authentic insights and valuable tips.
