595/69 Friday, October 30, 2026
Polymarket, an online prediction market platform, temporarily suspended trading on Polymarket.com on October 29, 2026, after discovering that a third-party service provider had been compromised and used to distribute malicious JavaScript. Polymarket switched the platform to cancel-only mode and suspended its relayer service while investigating the incident. The issue was resolved and normal trading resumed within approximately one hour. The company stated that it had referred the matter to law enforcement and would compensate affected users, although it has not yet disclosed the total number of victims or the overall financial impact.
Researchers from Hudson Rock identified malicious JavaScript distributed through cdn.debugbear[.]com, infrastructure associated with website performance monitoring provider DebugBear. The script was designed to hijack active trading sessions of logged-in users, inspect account balances and held assets, and then attempt to sell those assets or transfer tokens and other digital assets to attacker-controlled wallets. The script also communicated with data.debugbear.com to receive commands and exfiltrate account information, wallet details, balances, and transaction results. Further analysis found that a wallet embedded in the script had transferred approximately 28.6 million POL, valued at around USD 2.57 million, to another wallet. However, this amount has not been confirmed as the total loss resulting from the incident.
Polymarket users should review their trading history, open positions, and wallet transactions for activity they did not authorize, and monitor official Polymarket announcements regarding compensation for affected users. Organizations using DebugBear Real User Monitoring (RUM) should follow DebugBear’s guidance by temporarily removing its JavaScript embed code from their websites and reviewing logs and suspicious activity during the affected period. Particular attention should be given to websites where third-party JavaScript interacts with authenticated sessions or sensitive transactions, as the incident demonstrates the risk that compromised third-party scripts can be loaded and executed directly within websites trusted by users.