Polymarket Repays $3.9 Million After Hijacked Script Drained Wallets

Polymarket is returning $3.9 million to traders after hackers used a hijacked page-speed script to drain accounts on its international platform on October 29. The company says $2.7 million is going back to 726 drained wallets, and another $1.19 million to about 5,500 wallets that lost money when trading was paused or positions were taken, The Hacker News and Stocktwits reported.

By October 30, 689 of the 726 affected wallets had been refunded in full. The remaining 37 were being paid as each case was checked. Traders do not need to file a claim, and a form is open for anyone who thinks their payment is wrong.

How the theft worked

The attack did not break Polymarket's own trading contracts. The code came in through a script the site loaded from DebugBear, a British company whose real user monitoring tool measures how fast pages load. On October 29, the file served from DebugBear's content address was replaced with malicious code, researchers at Hudson Rock found. The code used the active sessions of traders who were signed in, sold positions and moved funds out.

Blockchain records show about $2.64 million reached the hackers' wallet in under an hour, and analytics firm Bitquery counted 985 unauthorized withdrawals between 17:10 and 18:10 UTC, The Hacker News reported. DebugBear said its DNS records were compromised through its domain registrar, and it told customers to remove its embed code. The address that served the bad file had no DNS record left when The Hacker News checked on November 1.

The response

Polymarket posted its first warning about unauthorized wallet activity at 17:38 UTC on October 29. At 18:05 UTC the exchange went to cancel-only mode. The company says it removed the script within the hour, cleared caches, reset all active sessions and paused trading until the site was clean. It referred the case to law enforcement in Britain. The separate regulated platform in the United States was not affected, Wired reported.

Why it matters

The theft came on the same day as the far larger attack on Binance, where $6.3 billion in tokens were stolen in a theft the FBI has attributed to North North Korea's TraderTraitor group. Together the two cases show two different weak points. Binance was hit at the exchange. Polymarket was hit through a small supplier script that many sites load without a second thought. Polymarket says it is bringing third-party scripts back with stronger checks, including a tighter content security policy, pinned versions and sandboxing.

This is not financial advice. Do your own due diligence.