Hackers stole wallets from around 700 Polymarket users for at least 2.7 million dollars

Polymarket suffered a cyberattack that allowed hackers to empty the digital wallets of hundreds of users and steal at least USD 2.7 million, according to estimates from specialized cryptocurrency analysis firms. The incident occurred on Thursday, October 29, and forced the suspension of operations on its international platform for approximately one hour, while technical teams attempted to contain the theft.

The company confirmed that the source of the problem was an external technology provider and announced that it would compensate the affected users. In an update released on Friday, October 30, it reported that 95% of the affected wallets had already received full refunds.

How the hack that affected Polymarket occurred

The first reports began in the afternoon on Thursday, when users reported on X that their positions had been sold without authorization and that their funds had disappeared.

One of the affected operators warned: "If you are a Polymarket user, protect your account. They just emptied 800,000 dollars from mine", according to the message collected by industry researchers.

At 2:05 PM Eastern Time, Polymarket activated a mode that only allowed the cancellation of existing orders.

The company explained: "One of our external providers was compromised, and we have referred the case to the relevant authorities". It then added: "Anyone who has been affected will be compensated".

Operations were restored around 3:05 PM, after technicians removed the compromised component and verified the service's functionality.

What is DebugBear and how the malicious code was introduced

The investigation pointed to DebugBear, a British company that offers services to monitor the speed and performance of websites. Polymarket was using a program from this provider to measure the performance of its site.

However, the attackers managed to replace it with a JavaScript code designed to exploit the sessions that users already had open.

DebugBear publicly acknowledged the incident and asked its clients to temporarily remove the monitoring code from their sites.

Researchers from Hudson Rock identified functions capable of querying available balances, selling positions, and sending cryptocurrencies to a wallet controlled by the attackers.

The attack did not need to directly compromise Polymarket's smart contracts: it used the usual operational tools through compromised sessions.

How many users were affected and how much money was stolen

Initial estimates from Betting Intelligence and Polysights identified at least 710 affected wallets and USD 2.7 million stolen.

Another analysis conducted by Bitquery counted 737 accounts and approximate losses of USD 2.73 million.

Meanwhile, BleepingComputer tracked movements of about 28.6 million POL tokens, valued at approximately USD 2.57 million at the time, from a wallet linked to the attack to three other addresses.

The differences in the figures are due to the various methods and times used to analyze the transactions.

How Polymarket refunds will work

On Thursday, Polymarket informed its users that those who had lost less than USD 10,000 would receive their money on Friday, October 30. For higher losses, it initially reported that a release form would need to be signed.

Subsequently, the company released an update on the progress of the refunds.

Polymarket announced that it will refund a total of USD 3.9 million: USD 2.7 million related to the attack and another USD 1.2 million to cover losses related to the service interruption.

Additionally, it reported that the refunds include forcibly sold positions and certain losses recorded during the suspension of operations.

What measures Polymarket took after the attack

The company removed the compromised code, deleted cached copies, and restarted the active sessions of its users.

It also announced new control measures for the external programs integrated into its platform.

The U.S. version of Polymarket, which operates independently and under a different regulatory framework, was not affected.