Emerging ThreatsData Breaches

Polymarket Breach Exposes $2.5M in Crypto Theft

Analyst 207||Source: BleepingComputer
Disrupted office workspace with laptop and cityscape, conveying concern.

"One of our third party providers was compromised, and we have referred this to relevant law enforcement," Polymarket said.

Polymarket's timeline and public response

Polymarket temporarily suspended trading on Thursday after a third‑party service distributed a malicious JavaScript designed to drain cryptocurrency from user wallets. The company placed its exchange into cancel‑only mode at 2:05 p.m. ET and paused relayer actions while investigators worked. At 2:37 p.m. ET Polymarket said the immediate issue had been fixed but kept trading halted out of caution. The platform marked the incident resolved and announced that trading was fully back online at 3:05 p.m. ET — roughly one hour after the initial suspension.

Polymarket posted on X that "Anyone who has been impacted will be made whole" and "We'll make this right and are fully reimbursing all affected traders." The company has referred the breach to law enforcement. Polymarket has not disclosed how many users were affected, how much cryptocurrency was stolen, or the operational details of the reimbursement process.

Malicious JavaScript hosted on DebugBear infrastructure

Security researchers at Hudson Rock found the malicious code hosted at cdn.debugbear[.]com/C7xcKKrjUnXK.js. DebugBear, a website performance‑monitoring service whose Real User Monitoring (RUM) product uses embedded JavaScript to collect client‑side performance metrics, confirmed it is "impacted by an ongoing security incident" and told customers to remove its RUM embed code from websites.

At the moment this story was published, DebugBear's website was inaccessible and displayed a Cloudflare error; the company said it is investigating. Hudson Rock also located Polymarket production build metadata with the commit message "chore(polymarket): remove debugbear rum script (#15337)" timestamped October 29 at 1:59 p.m. ET, shortly before Polymarket's public announcements.

Attacker wallet activity traced on the blockchain

Hudson Rock identified a suspected attacker‑controlled wallet embedded in the malicious script: 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18. BleepingComputer's blockchain analysis found that the wallet transferred approximately 28.6 million POL — valued at roughly $2.57 million — to three additional wallets.

Blockchain records show that the wallet executed numerous transactions involving Polymarket's prediction‑market token contract between 1:50 p.m. and 1:56 p.m. ET, in the window shortly before the exchange halted trading. Hudson Rock reported the wallet held about $2.19 million in cryptocurrency at the time of its investigation.

How the malicious script operated

BleepingComputer analyzed a copy of the JavaScript (via VirusTotal) and reported it was engineered to hijack authenticated Polymarket trading sessions, liquidate users' prediction‑market positions, and transfer crypto and token holdings to attacker‑controlled addresses. The malware first checks whether a visitor is logged into Polymarket and attempts to use that existing trading session and the platform's transaction functionality to perform unauthorized transfers.

It probes users' cryptocurrency balances and prediction‑market positions to determine value, then takes different actions depending on how a user authenticated. For some accounts the script attempted to automatically sell positions; for others it tried to transfer prediction‑market tokens directly to the attacker wallet. The malicious code also sought to convert cryptocurrency holdings into assets that could be moved to the attacker‑controlled wallet using Polymarket's own transaction features.

Further, BleepingComputer found the script communicated with data.debugbear.com to receive commands and exfiltrate information about targeted accounts, wallet addresses, balances, and transaction outcomes — indicating the DebugBear infrastructure was used both to distribute the malware and to serve as a command‑and‑control and data‑exfiltration channel.

What this means for Polymarket users, DebugBear customers, and security teams

  • Polymarket users: The company has promised full reimbursement for affected traders but has not provided specifics. Users will be watching for official guidance on the scope of impact and the mechanics of restitution.
  • DebugBear customers: DebugBear advised removing the RUM embed; customers must evaluate whether the monitoring script was present and take removal and containment steps while DebugBear investigates.
  • Security and incident response teams: The incident illustrates a compromise delivered through a third‑party monitoring provider and a JavaScript supply‑chain channel that also functioned as a command‑and‑control vector — a scenario incident responders will need to trace across CDN/RUM infrastructure, frontend builds, and on‑chain transaction logs.

The record in this event is concrete on method and timeline: a third‑party RUM script served malicious JavaScript that executed between roughly 1:50 p.m. and 1:56 p.m. ET, Polymarket moved to cancel‑only mode at 2:05 p.m. ET, and the exchange declared operations restored at 3:05 p.m. ET. Law enforcement has been notified, DebugBear is investigating, and Polymarket has pledged to reimburse affected traders — but the number of victims, final loss totals, and the details of remediation remain to be disclosed.

Source: BleepingComputer — Polymarket halts trading after crypto‑draining script breach, $2.5M traced

CryptocurrencyEmerging ThreatsFinancial ServicesSupply Chain AttackMalware OperationsCrypto TheftThird-Party BreachPolymarket
Related Intelligence

Continue Reading

Airport terminal scene with check-in counter, scattered passengers, and blurred laptop screen on travel agent's desk.

Amadeus Data Breach Exposes Airlines' Passenger Info

A massive data breach at Amadeus's Passenger Service System has compromised the sensitive information of around 92,000 Japan Airlines customers, with hackers gaining unauthorized access to the system over a prolonged period of nearly three years. The breach exposed passenger data, including details stored in the airline's travel booking display environment.

Analyst 207
Laptop on a desk in a minimalist room with soft natural light, screen blurred.

Hugging Face Hit by Resurgent Malware Campaign

Malware attackers cleverly exploited a tiny workflow change at Hugging Face, transforming trusted repositories into a powerful crypto-mining and backdoor distribution channel that racked up 28,412 downloads before being caught. In a cat-and-mouse game, 31 malicious repositories popped up across seven accounts in two waves since September, with attackers swiftly adapting to evade detection.

Analyst 207
Rows of computer servers and network equipment in a brightly-lit, empty server room with scattered cables and a blurred…

Cybersecurity Threats Exposed in Week of AI-Powered Attacks

This week, a shocking 40,573 secrets were exposed in a series of AI-powered cyberattacks, highlighting the ongoing struggle to protect sensitive information from falling into the wrong hands. The alarming findings, dubbed FortiBleed 2.0, reveal a disturbing trend of large-scale credential leakage and exploitation of old vulnerabilities.

Analyst 207
Server room interior with rows of equipment, one server highlighted with a red alert indicator.

Chinese Hackers Exploit PHP2Shell to Root 25 Servers

In a matter of hours, Chinese hackers exploited a PHP2Shell vulnerability to tunnel into an internal network, compromising multiple servers and launching a massive Active Directory attack campaign. The attackers rooted 25 servers and breached Palo Alto Networks firewalls across the US, Japan, Taiwan, and South Korea, with some networks still potentially under their control.

Analyst 207