Polymarket loses $2.7 million to compromised vendor script, returns $3.9 million to traders

Prediction market Polymarket said $2.7 million was drained from 726 wallets through a compromised third-party script, and that it is returning a total of $3.9 million, including compensation for traders hurt by its trading pause. In a post on its official X account on Oct. 30 (local time), the company said 689 of those wallets had been refunded in full.

One hour starting at 2:10 a.m. KST

The attack took place in the early hours of Oct. 30 Korea Standard Time (KST). On-chain records published by blockchain analytics firm Bitquery and security firm Report URI show the following sequence.

1. Oct. 30, 2:10 a.m.First POL (Polygon's token) arrives in the attacker's wallet
2. Oct. 30, 2:45 a.m.A trader posts on X, "I just got drained $800,000," urging users to lock down their accounts
3. Oct. 30, 2:59 a.m.Polymarket ships a new website build without the script
4. Oct. 30, 3:00 a.m.Performance-monitoring firm DebugBear says it is "impacted by an ongoing security incident" and asks customers to remove its embed code
5. Oct. 30, 3:06 a.m.Polymarket switches to cancel-only mode and pauses relayer actions (Discord notice)
6. Oct. 30, 11:37 p.m.Polymarket says 689 of 726 wallets have been refunded in full

Bitquery said the thefts occurred between 17:10 and 18:10 UTC on Oct. 29, or 2:10 a.m. to 3:10 a.m. KST on Oct. 30. Polymarket said, "The attack came through a compromised 3rd party provider which we removed within the hour."

A page-speed script that emptied wallets

Polymarket did not name the vendor. But Scott Helme, the security researcher who founded Report URI, said a DebugBear page-speed monitoring script loaded by Polymarket's website was replaced with malicious code at the same address. The original 60,493-byte file was swapped for a 15,187-byte wallet-draining script, and Polymarket's build log shows a commit titled "remove debugbear rum script."

According to Helme, the code hijacked the site's order functions in the browsers of users who were logged in to Polymarket. For users with self-custody wallets, outcome tokens were moved to the attacker's address in a single batch. For users who signed up by email, positions were sold off at 97% of the current price, then 50%, then the minimum tick. Remaining cash was converted to POL and sent to the attacker. Because every transaction went through Polymarket's normal relayer, they looked like ordinary orders. "The address of the script was identical before, during and after the attack. Only the bytes of the script changed," Helme wrote, so the browser security policy (CSP), which works by allowlisting addresses, did not catch it.

Report URI counted about 28.63 million POL, worth roughly $2.6 million, in the attacker's wallet at around 3:20 a.m. KST on Oct. 30. POL is listed on the Korean won markets of Upbit and Bithumb, and traded at 125 won on both exchanges as of 12:30 p.m. KST on Oct. 31.

$2.7 million lost, $3.9 million returned

On top of the $2.7 million taken directly, Polymarket said it is paying $1.19 million to about 5,500 wallets that lost money during the trading pause or had positions taken, starting Oct. 30. "No claims or tickets needed," the company said, adding, "We are in active investigation with law enforcement & will share a postmortem." The remaining 37 wallets are being paid as each is verified.

The losses were concentrated in a few accounts. Bitquery said $2.73 million was drained from 737 accounts, with a median loss of $171 per account. Four accounts that each lost more than $100,000 made up 43% of the total. Polymarket's figure of 726 wallets differs slightly from Bitquery's account count.

Another vendor breach in June took $3 million

This is the second time this year that Polymarket has been attacked through an outside vendor. On June 25, a compromised vendor led to a malicious script being injected into its website, and about $3 million was drained. Blockchain analytics firm Bubblemaps put the number of affected accounts at fewer than 15. Polymarket said then too that it would refund the losses in full. In May, about $700,000 was drained from a company wallet that employees used to top up and pay out user rewards.