ABAB News Logo
Back to Flash News

Polymarket international site suspends trading after a third-party service provider is compromised, pledges full reimbursement for affected users

Polymarket Traders (@PolymarketTrade) posted on October 29, 2026, that it had identified and fixed an issue affecting its international version platform, Polymarket.com, because a third-party service provider had been compromised, and had referred the matter to the relevant law enforcement authorities; anyone affected will receive full reimbursement. Out of caution, the platform has temporarily stopped trading and is working to restore the site.

The platform status page showed that the exchange had at one point entered cancel-only mode and paused relayer operations to carry out an investigation; it later confirmed that the issue had been fixed and trading had resumed. Trader Car (@CarOnPolymarket) posted that his account had about $800,000 transferred out without authorization, all positions had been sold, and mentioned that a friend lost about $600,000.

Decrypt and The Block cited Arkham data as saying that the suspected attacker address 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18 converted the obtained USDC.e and USDC into POL and at one point held about $2.65 million in POL; subsequent reports said the address transferred out about 28.64 million POL in three transactions. Cybersecurity company Hudson Rock analyzed that the address was hard-coded as a backup receiving address in a script containing wallet-draining code hosted by the web performance monitoring service DebugBear; the script reads authentication parameters, proxy wallet addresses, and trading API keys from browser local storage, and attempts to sell positions or transfer assets targeting logged-in sessions. Polymarket production build metadata shows that the DebugBear RUM script has been removed.

Original sources:

  1. Title: We've identified & fixed an issue impacting our international platform, Polymarket.com. Publisher: Polymarket Traders (@PolymarketTrade) Publication date: 2026-10-29 URL: https://x.com/PolymarketTrade/status/2115874609014726842 Source type: Official platform account post Verification status: Full original post read Support content: third-party service provider compromise, referral to law enforcement, pledge of full reimbursement, temporary halt to trading

  2. Title: The exchange is currently in cancel-only mode and relayer actions paused while we investigate an incident. Publisher: Polymarket Status Publication date: 2026-10-29 URL: https://status.polymarket.com/cmvtuswgi00221bkzps7w21pt Source type: platform status page Verification status: incident timeline and updates read Support content: cancel-only mode, relayer paused, issue identified and fixed, trading resumed

  3. Title: Polymarket Pauses Trading as Prediction Market Investigates Security Incident Publisher: Decrypt Publication date: 2026-10-29 URL: https://decrypt.co/382185/polymarket-pauses-trading-prediction-market-security-incident Source type: English media report Verification status: full article read Support content: Arkham data showing address holding about $2.65 million in POL, Hudson Rock script analysis, Car user post, earlier events in May and June

  4. Title: Polymarket Hack: Third-Party Script Drains User Wallets Publisher: Cyber Kendra (citing Hudson Rock) Publication date: 2026-10-30 URL: https://www.cyberkendra.com/2026/10/polymarket-hack-debugbear-script-drains-wallets.html Source type: security analysis report Verification status: Hudson Rock analysis summary read Support content: DebugBear script content, local storage access, backup receiving address, removal record in build metadata

  5. Title: Polymarket Pauses Trading After Some Users Report Funds Drained Publisher: The Wall Street Journal Publication date: 2026-10-29 URL: https://www.wsj.com/business/polymarket-pauses-trading-after-some-users-report-funds-drained-b014527d Source type: English media report Verification status: public summary read Support content: DebugBear security flaw, UK law enforcement, third-party vendor

ABAB AI Insight

This incident forms a continuous pattern with Polymarket’s internal top-up wallet private key leak in May 2026 (about $700,000) and the June third-party vendor frontend script injection (about $3 million, fewer than 15 accounts). In all three cases, the issue involved third-party components or keys outside the platform’s direct control, rather than the smart contract itself being directly breached. Hudson Rock’s static analysis shows that the DebugBear RUM script was implanted with logic specifically targeting Polymarket’s frontend, using permissions from the transaction client and signer within users’ authenticated sessions to transfer assets through sell orders or batch transfers, a typical frontend supply-chain attack.

The address 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18 flagged by Arkham matches the hard-coded backup receiving address in the script, and the fund path was USDC.e/USDC converted into POL via Relay, then held centrally and transferred out. WSJ and WIRED reports identify the involved vendor as being in the UK, and note that Polymarket US, an independent platform regulated by the CFTC, was not affected, showing the technical and regulatory separation between the international site and the U.S. site in this incident.

The platform pledged full reimbursement but did not disclose the number of affected users or the total losses; WIRED cited Bubblemaps as saying there were about 700 accounts and about $2.7 million. Compared with the June incident, this attack was carried out through a performance monitoring script rather than directly injecting a site dependency, and DebugBear itself issued a public notice removing the RUM embedded code, showing that the vendor side has confirmed its service was exploited.

Prediction market frontends rely on many third-party scripts (analytics, login, monitoring), and a supply-chain attack can transfer assets without touching on-chain contracts. After three consecutive third-party-related incidents, Polymarket is still publicly describing the events as a “third-party service provider compromise,” without naming the specific vendor, and has not provided an independently audited total loss figure; the pace and scope of the reimbursement commitment remain to be confirmed in later status page updates or announcements.

ABAB News · Laws of cognition

  1. A frontend supply-chain attack does not touch the contract, yet it can directly use authenticated session permissions to transfer assets.

  2. Once a third-party monitoring script is replaced, the domain trusted by CSP becomes the entry point for full page permissions.

  3. After three consecutive third-party-related incidents, the platform still summarizes them as a “service provider compromise,” while the total losses and number of users remain undisclosed.