Polymarket temporarily suspended trading on its international prediction-market platform after attackers compromised a third-party provider and injected malicious JavaScript to steal cryptocurrency from users. The company placed its exchange in cancel-only mode, paused trading-related activities and restored operations approximately one hour later. Polymarket confirmed the compromised integration was removed, notified law enforcement and promised to reimburse affected traders. Independent blockchain researchers estimate approximately 700 accounts were affected, with losses reaching $2.7 million, although the company has not confirmed those figures.
ATTACKERS EXPLOITED THIRD-PARTY MONITORING SOFTWARE
The attack was linked to DebugBear, a website performance-monitoring provider whose embedded JavaScript was reportedly compromised. The malicious script exploited authenticated Polymarket sessions to inspect cryptocurrency balances, liquidate trading positions and transfer assets into attacker-controlled wallets. Because the code operated within Polymarket’s website, attackers could abuse legitimate platform functions without stealing passwords or requiring users to install malware. Blockchain investigators traced approximately $2.5 million to $2.7 million in suspected stolen cryptocurrency, demonstrating how third-party software supply-chain attacks can cause significant financial losses.
SECURITY RISKS AND DEFENSIVE MEASURES
The Polymarket breach highlights the dangers of allowing third-party JavaScript to execute within financial applications. Organizations should strengthen Content Security Policy protections, monitor external scripts for unauthorized modifications, restrict access to sensitive functions and require additional authorization for high-risk transactions. Security teams should also investigate suspicious session activity and review third-party integrations regularly. Affected Polymarket users should examine their transaction histories, review connected wallets and revoke unnecessary token approvals. The incident reinforces the importance of treating external monitoring and analytics scripts as potential security risks rather than harmless website components.