Polymarket resumed trading on Oct. 29 after a compromised third-party provider disrupted its international prediction-market platform, marking the second reported multimillion-dollar security incident affecting the service in four months. The company said it had fixed the problem, referred the matter to law enforcement and would reimburse affected users, but its official incident notice did not state the total loss.
October disruption involved trading and signing tools
Polymarket’s incident record shows that trading was restricted from 18:05 UTC on Oct. 29 and restored one hour later, at 19:05 UTC. The immediate interruption was linked to malicious code associated with an outside provider. According to CryptoSlate, researchers later examined recovered code that appeared to search for financial tools inside a logged-in trading session.
Hudson Rock said the script, downloaded from a DebugBear-associated URL, looked for Polymarket’s live trading client and its signer. A signer is the component that requests cryptographic authorization for an action. The recovered code contained different branches depending on the type of account involved. One branch sought transfers of position tokens, while another targeted the sale of positions and the movement of proceeds.
Those findings do not establish that the script silently obtained signatures, stole private keys or completed every transfer it was designed to attempt. Hudson Rock’s static analysis also did not produce a complete trail connecting individual victims to recipients. Production-build metadata showed that the DebugBear monitoring script had been removed, but that information did not resolve precisely when users were exposed or how far the incident reached.
Blockchain analytics firm Bubblemaps estimated that more than 700 Polymarket users were affected. Its assessment put the value of compromised assets at approximately $3.46 million. About $2.7 million was converted into POL and transferred away, while roughly $750,000 remained on Polymarket when the estimate was made.
Earlier attack used a different route
The October incident followed a June 25 attack involving another compromised vendor. Polymarket previously said that a malicious script had been injected through a third-party dependency, which it removed, and promised full refunds to affected users.
Source Defense reported that approximately $3 million was drained in the June incident. Its investigation traced the delivery chain through a marketing tag that loaded an external identity library. The attacker replaced that library with a Polymarket-specific drainer.
According to the researchers, the June payload focused on wallets holding more than $100,000 and repeatedly requested a digital authorization. Once a user approved the action, it was submitted through Polymarket’s relayer—the infrastructure used to send signed transactions or actions on the platform.
The two incidents therefore involved different delivery mechanisms and different apparent behaviors. The June attack relied on users approving authorizations through an affected interface. The October code, by contrast, was described as seeking access to trading tools and signature-related functions within a live session. The distinction matters because the central security question is not only whether a vendor is compromised, but also how much authority third-party code can exercise after reaching a trading page.
Why browser integrations matter
A third-party script directly included on a webpage can generally interact with that page’s other scripts and data, according to browser documentation from MDN. Merely hosting the file on another domain does not remove that access. Content placed in a separate frame has a different security boundary, but the two arrangements are not equivalent.
That makes integrations on pages handling trading and digital signatures particularly important. The June marketing dependency and the October monitoring-associated script were separate routes into a sensitive environment. Limiting unnecessary outside code, narrowing signer permissions and requiring fresh confirmation for important actions address different parts of the potential attack chain.
Subresource Integrity is one browser-based control that can help verify downloaded scripts. It allows a browser to compare a file with an expected cryptographic fingerprint and reject content that has changed. A correctly pinned resource can remain protected by that check even when it is hosted on a domain that users otherwise trust.
Polymarket’s promise to reimburse affected users addresses the immediate financial impact, but a fuller postmortem would be needed to clarify the exposure window, the accounts involved and the authorization paths used. Those details would help users and security researchers assess whether a future compromise of an outside integration could again turn access to the trading interface into usable financial authority.
Moneyiar market picture
Moneyiar market data at the stated times shows the following prices and recent changes:
- JUST (JST): $0.1406984321, down 0.14% over 24 hours and up 3.79% over seven days, as of Oct. 25, 2026, at 22:38 +03:30.
- Polygon (prev. MATIC) (POL): $0.0898082186, up 0.39% over 24 hours and down 0.74% over seven days, as of Oct. 25, 2026, at 22:39 +03:30.
- Monad (MON): $0.0215496181, down 0.49% over 24 hours and up 2.33% over seven days, as of Oct. 25, 2026, at 22:38 +03:30.
These market figures are separate from the Polymarket security incident and do not measure the value of assets affected in the breach.
