The short version
- Polymarket hack: a page speed script from an outside provider turned Polymarket.com into a wallet drainer on October 29 and took about $2.65 million from traders.
- No smart contract was broken; the code used traders’ logged-in sessions to sell positions and send the money out, and Polymarket says everyone hit will be made whole.
- The crew is watching for Polymarket’s refund details and any other sites that ran DebugBear’s code, which the provider told customers to remove.
The Polymarket hack didn’t need a fake link. Traders lost money on the real Polymarket.com on Thursday, October 29, after a script from an outside provider was turned into a wallet drainer. About $2.65 million left user accounts, according to Arkham data on the suspected attacker’s wallet, and Polymarket says everyone hit will be made whole.
Polymarket says the problem hit its international platform. Its separate US exchange wasn’t part of it.
Here is the statement Polymarket posted on X at 18:33 UTC:
We've identified & fixed an issue impacting our international platform, Polymarket.com. One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement.
Anyone who has been impacted will be made whole.
Out of an abundance of caution, we
How Did the Polymarket Hack Work?
Through a page speed tool. DebugBear, a UK company that measures how fast websites load, posted at 18:00 UTC that it was hit by an “ongoing security incident” and told customers to remove its code from their sites. Polymarket hasn’t named the provider behind the Polymarket breach.
Security firm Hudson Rock pulled the file from DebugBear’s servers while it was still live. The code looked for a trader who was logged in, read their positions and balance, then tried to sell the positions and move the money out. A hard-coded wallet was the fallback recipient. Hudson Rock found nothing that stole passwords or seed phrases. The script simply used the session that was already open.
The money was swapped into POL, which can’t be frozen the way stablecoins can. Onchain trackers count somewhere between about 700 and 995 drained accounts. Polymarket hasn’t confirmed either number.
Sponsored · Affiliate link
Save 20% on fees trading on WEEX
Base Camp may earn a commission if you sign up. It never affects what we write.
What Did Polymarket Do?
It froze trading for about an hour and promised to pay everyone back. The exchange went to cancel-only mode at 18:05 UTC, so traders could pull orders but not place new ones, and paused its relayer, the service that sends account actions onchain. That is on its status page.
At 18:37 UTC it said the issue was found and fixed and the case went to law enforcement. Trading came back at about 19:00 UTC (3:00 p.m. in New York):
Trading is now fully back online.
We’ll make this right and are fully reimbursing all affected traders.
Polymarket says it is “fully reimbursing all affected traders.” There is no timeline for the Polymarket reimbursement yet. The flaw sat in the website, not in Polymarket’s smart contracts.
SIDE TRAIL: Keystone Wallet Breach: Maker to Destroy 18,835 Devices After Key Theft
Why Does This Matter?
Because this Polymarket hack is the second time since June that an outside script on Polymarket’s site emptied users’ accounts. That attack took about $3 million, and Polymarket promised refunds then too.
Both times the traders did nothing wrong. They opened the right website, and the weak spot was a piece of code most people never knew it loaded. If you traded there on Thursday, check your activity history and watch for Polymarket’s refund notice.
TRAIL MAP: The 10 Most Common Crypto Scams and How to Spot Them
In crypto since 2017, trading stocks for over 20 years. MBA. Follows the economic data and US markets closely.
More from Satoshi Flipper →
