Tampered monitoring script let hackers empty Polymarket users' wallets

Hackers took roughly $2.7 million from hundreds of users of Polymarket’s international platform on 29 October 2026, GamblingNews reported. Polymarket stopped trading for about an hour and has since resumed.

The report says the attackers tampered with the site’s JavaScript through a script hosted by DebugBear, a third-party performance-monitoring service. The altered code allowed them to use sessions in which users were already logged in. They then sold or moved assets from customers’ wallets to wallets they controlled. Users did not need to click a phishing link or have a password stolen. The US-facing platform was not the target.

The details

Polymarket has not confirmed how many customers were affected or how much was taken, the report says. Outside estimates differ:

• Bubblemaps, a blockchain analytics firm, put the number of affected users at 700.
• Bitquery, another blockchain firm, counted 737 users and $2.73 million stolen.
• BleepingComputer traced about $2.57 million in POL, the Polygon network’s token, from a suspected attacker’s wallet.

Polymarket acknowledged the attack, promised to reimburse affected users and referred the incident to UK law enforcement. DebugBear also acknowledged the incident. It asked clients using its Real User Monitoring product to remove its embedded code from their websites.

What’s next

The report gives no date for reimbursements and does not say whether the attackers have been identified.