Polymarket paused trading on its international platform on October 29 after users reported funds leaving their accounts without permission, according to Decrypt. The company said one of its third-party providers was compromised and that it had identified and fixed the issue, referred the matter to law enforcement and intends to make affected users whole.
Security firm Hudson Rock said a script loaded from DebugBear, a web performance monitoring service, contains code that looks for logged-in users’ trading sessions and tries to sell their positions and transfer the assets. Polymarket did not name the provider in Decrypt’s report. The Hacker News later wrote in its November 2 weekly recap that about $2.7 million was drained from 33 deposit wallets in under an hour and that a similar third-party incident in June cost about $3 million.
Decrypt reported that a suspected attacker wallet held about $2.65 million in POL, based on Arkham data, after swaps from USDC.e through Relay, and that Hudson Rock had not determined how many users were affected. Reimbursement had not been confirmed beyond Polymarket’s stated intention. At the time of the report the exchange was in cancel-only mode, relayer actions were paused and the trading API was in a major outage.