Polymarket halts trading after supply-chain attack drains about $2.7 million

On 29 October 2026, Polymarket — the cryptocurrency-based prediction market — halted trading on its international platform after a supply-chain attack injected wallet-draining code into its website. The malicious JavaScript hijacked users' authenticated sessions and manipulated the transactions presented for approval, draining an estimated $2.7 million in crypto assets before the company cut trading to a halt. Polymarket said its own backend was not breached and that the compromise stemmed entirely from a third-party provider.

How the attack worked

Researchers at Hudson Rock linked the tampered code to a JavaScript file served by DebugBear, a UK-based website-performance monitoring firm whose real-user-monitoring snippet was loaded by Polymarket's frontend. DebugBear confirmed it had been "impacted by an ongoing security incident" and advised customers to remove its snippet. Because the malicious script ran inside visitors' browsers, users who approved what looked like routine market actions were in fact authorising transfers that emptied their wallets — a browser-side compromise that left Polymarket's servers and order-matching backend untouched.

Scale and response

Estimates of the loss varied as investigators tracked the attacker's wallets: Hudson Rock identified about $2.19 million at a fallback address it cautioned was not a verified total, while GoPlus put the figure near $2.71 million and counted several hundred deposit addresses — a count it stressed does not equal the number of victims. Polymarket switched its exchange to cancel-only mode, suspended relayer actions, and referred the matter to UK law enforcement. Trading resumed roughly an hour after the halt, and the company pledged that "anyone who has been impacted will be made whole." Polymarket's separate US platform was not affected. The incident was the second supply-chain compromise to hit Polymarket's frontend in 2026, following a June attack that drained about $3 million, underscoring how third-party browser scripts have become a recurring weak point for crypto platforms.