Polymarket temporarily restricted trading on its international exchange on October 29 after a third-party provider was compromised. The company said it had identified and fixed the issue, referred the incident to law enforcement, and committed to making affected customers whole. Its official status page recorded the disruption as lasting one hour.
The exchange entered cancel-only mode at 2:05 p.m. Eastern time, with relayer actions also paused. An update at 2:37 p.m. said the underlying issue had been fixed, but trading remained suspended as a precaution. The incident was marked resolved at 3:05 p.m.
“One of our third party providers was compromised, and we have referred this to relevant law enforcement,” Polymarket said in its status update. The notice identified the affected service as Polymarket.com, its international platform.
Security researchers linked the attack to JavaScript distributed through infrastructure belonging to DebugBear, a website performance-monitoring provider. DebugBear’s Real User Monitoring product uses code embedded in customers’ websites to collect information about loading speeds and user experience.
Researchers trace malicious code and cryptocurrency transfers
In its examination of the malicious script, BleepingComputer found functionality designed to misuse authenticated Polymarket sessions. The code checked account balances and prediction-market positions, then attempted to sell holdings or transfer assets using the platform’s existing transaction functions. Its behavior varied according to how the customer had authenticated.
The publication’s blockchain analysis identified approximately 28.6 million POL, valued at roughly $2.57 million, moving from a suspected attacker wallet to three other addresses. That traced amount should be distinguished from a company-confirmed loss total. Polymarket had not disclosed the full amount stolen or the number of affected customers in the statements reviewed.
The incident involved malicious code running through the legitimate platform rather than a separate imitation website. BleepingComputer also identified communications through DebugBear infrastructure involving account information, balances, and transaction results. DebugBear acknowledged a security incident and advised customers to remove its monitoring embed code.
The affected international platform operates separately from Polymarket’s U.S. exchange, whose Michigan sports-contract withdrawal was previously covered by MagBet. The October 29 security notice concerned the international service; its public incident record ended with confirmation that the disruption had been resolved.
