Arkham Data Shows Suspected Polymarket Attacker Address Once Held About $2.65 Million in POL and Transferred It Out
According to reports from The Block and Decrypt, Arkham data shows that the suspected Polymarket attacker address (0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18) exchanged the USDC.e and USDC it obtained into POL, at one point holding about $2.65 million in POL. Polygonscan shows that the address has since transferred large amounts of POL out in multiple transactions.
Cybersecurity company Hudson Rock said that the address was hardcoded in a script hosted by web performance monitoring service DebugBear that contained wallet-draining code, serving as a backup receiving address. Polymarket production build records show that the DebugBear script has been removed. Previously, Polymarket said that a third-party service provider had been compromised and that affected users would be fully compensated.
According to Decrypt, this is Polymarket’s third security incident this year. Previously, in May, an internal wallet was compromised, causing about $700,000 in losses, and in June, a third-party supplier’s front end was compromised, with estimated losses of about $3 million; the company promised compensation in both cases.
Original sources:
Title: Polymarket Pauses Trading as Prediction Market Investigates Security Incident Publisher: Decrypt Publication date: 2026-10-29 URL: https://decrypt.co/382185/polymarket-pauses-trading-prediction-market-security-incident Source type: media report Verification status: full text actually read in this instance, verification date 2026-10-29 Supporting content: Arkham data showed the suspected attacker address held about $2.65 million in POL; Hudson Rock said the DebugBear script contained wallet-draining code and hardcoded the address as a backup receiving address; Polymarket had removed the script
Title: Polymarket Breach Alert: Wallet-Draining Code Found in a Third-Party Script Publisher: Hudson Rock / InfoStealers Publication date: 2026-10-29 URL: https://www.infostealers.com/article/polymarket-breach-alert-wallet-draining-code-found-in-a-third-party-script/ Source type: security research analysis Verification status: full text actually read in this instance, verification date 2026-10-29 Supporting content: Hudson Rock examined the DebugBear script and found wallet-draining logic, with the hardcoded backup receiving address as 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18; Polymarket build records showed the script was removed
Title: Polymarket says hackers stole users' funds Publisher: TechCrunch Publication date: 2026-06-25 URL: https://techcrunch.com/2026/06/25/polymarket-says-hackers-stole-users-funds/ Source type: media report Verification status: full text actually read in this instance, verification date 2026-10-29 Supporting content: In June, a third-party supplier was compromised and malicious scripts were injected into the front end, with PeckShield estimating about $3 million in losses; the company promised full compensation
ABAB AI Insight
Arkham and Polygonscan data point to address 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18 receiving and converting assets into POL during the incident, peaking at about $2.65 million, and then transferring them out. Hudson Rock’s analysis matched this address to the hardcoded receiving address in a DebugBear-hosted script, which was described as reading user sessions and attempting to sell holdings or transfer assets. Polymarket’s build metadata recorded the removal of that script.
On the capital flow side, the attack was carried out through a third-party front-end script rather than by directly breaking the smart contract. The script ran in authenticated sessions on the official website and used existing trading permissions to sell holdings or batch-transfer tokens. Funds were then exchanged into POL through a relay service and transferred out. The official side did not confirm the total losses or the number of affected accounts; third-party estimates and user reports, such as Car’s report of $800,000, are external observations.
A comparable case is Polymarket’s incidents in May and June this year: May involved a private key leak in an internal deposit wallet, causing about $700,000 in losses; June involved third-party supplier front-end injection, with an estimated about $3 million transferred out from a small number of accounts. Both times, compensation was promised, and neither involved the core contract being directly breached. The pattern in this incident is similar to June, in that a supply-chain front-end dependency was exploited.
What this incident changes is the exposure of prediction-market platforms’ reliance on third-party monitoring scripts: after the performance-monitoring tool was replaced with wallet-draining logic, users’ actions on the official domain could lead to asset transfers. For Polymarket, full compensation helps maintain trust, but the lack of disclosure of the specific service provider and the total loss amount leaves external verification dependent on on-chain and third-party analysis. The indicators to watch are subsequent compensation progress, whether law-enforcement investigations disclose more details, and whether the platform changes its reliance on third-party scripts.
ABAB News · Cognitive Law
After a third-party monitoring script is replaced, it can execute position sales and asset transfers within an authenticated session on the official website.
On-chain address peak holdings and transfer records provide external observation, but the official side has not confirmed the total loss figure.
Of this year’s three security incidents, two involved third-party front ends, and the core contract itself was not directly breached.