Polymarket temporarily suspends trading on its international cryptocurrency platform after a security incident tied to a third-party provider results in crypto being moved from some traders’ wallets. Multiple outlets report the disruption lasts about an hour before trading resumes, and Polymarket says it will reimburse affected users. The incident is linked to a hijacked JavaScript script associated with DebugBear, a UK-based performance and monitoring vendor.
The reported mechanism involves malicious code replacing the legitimate monitoring script that Polymarket’s site loads from outside. Sources say the altered script takes advantage of traders who are already signed in, enabling the attackers to sell positions and transfer funds without stealing password or key material. Polymarket’s refund figure is reported as about $2.7 million across 726 wallets, while blockchain analyses in some accounts trace about $2.64 million reaching an attacker wallet within roughly an hour.
DebugBear says its DNS records were compromised through its domain registrar, and early findings indicate targeting of a specific customer website rather than a breach of its own systems. Outlets differ mainly on how much they specify about traced amounts, affected counts, and whether they add related context about impacts on other Polymarket services or prior vendor-compromise incidents.
