Polymarket briefly pauses platform after compromised monitoring tool drains user wallets

Prediction market platform Polymarket briefly suspended trading on its international site Thursday afternoon after attackers breached an external service to inject malicious code into user sessions. Trading went into cancel-only mode at 2:05 p.m. ET before the company fully brought operations back online at 3:05 p.m. ET. Polymarket announced it referred the incident to law enforcement and promised that impacted traders will be fully reimbursed, though it did not specify the total stolen amount or how many accounts were affected. [1][2]

Security researchers at Hudson Rock identified the attack vector as a compromised script hosted by website performance tracker DebugBear, which warned customers on X to remove its Real User Monitoring code amid an ongoing security incident. Once loaded in a visitor's browser, the malware hijacked active Polymarket sessions, evaluated account balances, and liquidated positions or diverted prediction-market tokens directly into a suspected attacker wallet. Hudson Rock reported the wallet held roughly $2.19 million, while BleepingComputer observed around 28.6 million POL, worth approximately $2.57 million, routed to three subsequent addresses. [1]