Polymarket hack: how a third-party script drained users

Developing story. Last updated October 29, 2026, afternoon ET.

Short version: On October 29, 2026, a compromised third-party script on polymarket.com used people’s logged-in sessions to sell their positions and send the money to an attacker. Polymarket paused trading, said one of its providers was compromised, and says affected users will be made whole. It’s the second time since June that a vendor’s script has been used to drain Polymarket users.

What happened in the Polymarket hack?

On Thursday afternoon, Polymarket users started posting that their positions had been sold at steep discounts and the money was gone. About half an hour later the bad code was off the site and trading was switched to cancel-only. Polymarket said “One of our 3rd party providers was compromised.”

All times UTC, October 29:

Around 17:30: users start reporting drained wallets (BNO News).
Around 18:00: the malicious code stops being served and Polymarket puts the exchange in cancel-only mode. Orders can be cancelled, nothing new goes through.
Later: Polymarket says it found and fixed the cause, referred it to law enforcement, and that “Anyone who has been impacted will be made whole.” It hasn’t said how refunds will work.

How much was stolen?

Nobody has a confirmed number yet. The $2.65M in headlines is the balance Arkham linked to a suspected attacker wallet, not a confirmed loss total. BNO describes losses in the hundreds of thousands, and one trader told Decrypt he lost $800K, which hasn’t been verified. The number of affected users hasn’t been reported.

What did the malicious script do?

Polymarket hasn’t named the provider. According to BNO News, people tracking the attack said the code came from DebugBear, a website performance monitoring tool Polymarket was loading on its site. DebugBear hadn’t commented when we published this.

From what’s been reported so far:

It used what was already in the browser. The code reportedly collected information about active users and used the trading credentials Polymarket stores in the browser’s local storage.
It sold positions cheap. Users say their open positions were sold at steep discounts and their balances sent to the attacker.
Some users saw a suspicious signing request. crypto.news published a screenshot of an unverified “DepositWallet” request that popped up on the site.

It never needed anyone’s password. It just used the session people were already logged into.

We’ll add more detail as more analysis comes out.

How is this different from the June Polymarket hack?

June’s attack, per cside’s analysis, was approval phishing. A poisoned vendor script popped up a malicious approval or signature request inside the real Polymarket site, and anyone who signed gave the attacker access to their funds. About $3M was taken.

This time it also used trading credentials that were already sitting in the browser, so it didn’t have to wait for anyone to sign something.

How do you protect your site from third-party script attacks?

If users can move money on your site, every third-party script on those pages can do whatever your own code can.

List every third-party script on your logged-in pages. Analytics, performance monitoring, chat widgets, A/B testing. Each one has full access to the page.
Don’t count on CSP alone. A Content Security Policy allowlists domains. It does nothing when an allowed domain starts serving bad code.
Know where SRI helps and where it doesn’t. Subresource Integrity pins a script to an exact hash, so a swapped file gets blocked. Most vendor scripts change all the time and don’t support it. Self-hosting a pinned version is the fallback.
Assume anything in localStorage can be read. Any script on your origin can read it. HttpOnly cookies keep tokens away from JavaScript, but a script on the page can still make requests as the logged-in user.
Keep third-party scripts off the pages that matter most. Performance monitoring on your marketing site is fine. On the page where people trade or send money, it’s one more company that can act as your users.

FAQ

Which vendor was compromised in the Polymarket hack?

Polymarket hasn’t said. BNO News reported that people tracking the attack traced the code to DebugBear, a website performance monitoring tool. DebugBear hadn’t commented as of October 29.

Will Polymarket refund affected users?

Polymarket says “Anyone who has been impacted will be made whole.” It hasn’t explained how yet. After the June hack it promised full refunds to affected users.

How did the attacker get users’ money?

Reports so far say the script used trading credentials stored in the browser to sell users’ positions at steep discounts and send the money to the attacker.

Is Polymarket trading back?

BNO News reported that trading resumed around 3pm ET on October 29. Polymarket hadn’t posted an update on its status page when we published this.

Why we’re writing about it

Zirahn builds policy checks for AI agents. Agents act with their user’s access, same as this script did, so attacks like this are the ones we pay the most attention to.

We’ll update this post as Polymarket and the provider share more.

Polymarket hacked again through a third-party script