Polymarket’s international exchange lost about $2.7 million on Thursday, October 29, 2026, after a hijacked page-speed script turned logged-in traders’ own browser sessions against them. That’s the short version of the Polymarket DebugBear hack, and it’s worth reading slowly, because no smart contract broke and no password was cracked.
Reports published November 1 put the affected count at 726 wallets and total refunds at about $3.9 million, a figure that includes $2.7 million returned to drained wallets plus about $1.19 million for roughly 5,500 wallets hurt by the trading pause. Polymarket halted trading for about an hour on October 29, then brought the international platform back online the same afternoon.
No password was stolen.
Polymarket DebugBear hack: how a speed script turned into a drainer
DebugBear sells a real user monitoring product, usually shortened to RUM. Sites embed its small JavaScript file so they can measure how fast pages load for real visitors. Polymarket.com loaded that file, which meant the code ran inside every visitor’s browser with the same trust as Polymarket’s own code.
On October 29, the file served from DebugBear’s content delivery address was replaced with malicious code, according to analyses by Hudson Rock and BleepingComputer. DebugBear later said its DNS records were compromised through its domain registrar, and it told customers using its monitoring product to remove the embed code. It said it had found no breach of its own internal systems, a detail that matters because it points to how the script was swapped, not to a break-in at Polymarket’s servers.
Once the swapped script loaded, it checked whether a visitor was signed in to Polymarket. If the answer was yes, it used that live session to sell positions, transfer prediction-market tokens, or convert balances into assets that could be sent to an attacker wallet. Blockchain analysts traced about $2.65 million to a suspected attacker wallet, while other estimates ranged from about $2.2 million to $2.7 million. Bitquery counted 985 unauthorized withdrawals between 1:10 p.m. and 2:10 p.m. ET, a window that shows how fast the drain ran.
Polymarket’s own build history tells part of the timeline. A production build stamped 1:59 p.m. ET on October 29 carried a commit message about removing the DebugBear RUM script. At 2:05 p.m. ET, Polymarket put the international exchange into cancel-only mode and paused its relayer, the service that submits transactions for users. By 2:37 p.m. ET it said the issue was fixed, and trading was marked resolved at 3:05 p.m. ET.
What Polymarket and DebugBear said
Polymarket did not name DebugBear in its public posts. “One of our third party providers was compromised, and we have referred this to relevant law enforcement,” the company said on X, adding that trading had been halted out of caution while it worked to bring the platform back online.
“We’ll make this right and are fully reimbursing all affected traders,” Polymarket said in a later post. CNBC reported that traders who lost less than $10,000 would have funds restored by October 30, while larger claims would need a signed release agreement before reimbursement. Reports on November 1 said 689 of the 726 drained wallets had been refunded in full by October 30, with the remaining 37 being paid as they were checked.
DebugBear’s message was narrower and more technical. It said it was responding to an ongoing security incident and asked RUM customers to pull its script from their sites. For any site still running the embed, that instruction was the urgent part. Removing the script closed the hole even before anyone could explain exactly how the DNS records were changed.
Polymarket’s US platform was not affected, according to CNBC and NBC News. That split matters for American readers. Polymarket US runs separately under US financial regulation, while Polymarket.com is the crypto-based international exchange. Anyone who only uses the US platform was not in the path of this script.
Why this breach should worry more than its dollar figure
$2.7 million is small next to the $6.3 billion Binance theft reported the same week, and Polymarket itself says its incident is separate from that theft. Don’t let the smaller number fool you. This was the platform’s second vendor-related frontend incident this year, after a similar compromised-vendor script hit Polymarket in June 2026.
Here’s the uncomfortable part. Nothing about the attack required breaking Polymarket’s core systems. A browser cannot tell the difference between a site’s own code and a third-party script the site chose to load. When that script can read a signed-in session, it inherits everything the user can do on that page. Security teams audit servers, contracts, and APIs. They don’t always audit every marketing, analytics, and performance script with the same care, even though those scripts run in the same browser context as the money.
For traders, the practical takeaway is simple. Keep large balances off any web session you don’t need open, sign out when you’re done trading, and treat a sudden flurry of unauthorized transactions as a reason to revoke sessions and contact the platform at once, not after the market moves. For platforms, the fix is less simple but clear: lock down third-party scripts, pin the exact files you allow to load, and monitor vendor code for changes the way you monitor your own releases.
Frequently asked questions
What happened in the Polymarket DebugBear hack?
A compromised DebugBear monitoring script on Polymarket’s international site used logged-in traders’ browser sessions to sell positions and move funds to an attacker wallet on October 29, 2026.
How much money was taken in the Polymarket hack?
Blockchain analyses put the drained amount at about $2.7 million across roughly 726 wallets, with some estimates ranging from $2.2 million to $2.7 million. Polymarket has not published its own confirmed total.
Was Polymarket US affected by the DebugBear breach?
No. Reports from CNBC and NBC News say the breach affected Polymarket’s international platform, Polymarket.com, and did not affect Polymarket US.
Will Polymarket refund traders who lost money?
Yes. Polymarket says it is fully reimbursing affected traders, and reports published November 1 put total refunds at about $3.9 million, including compensation for traders hurt by the trading pause.
Sources: BleepingComputer, CNBC, CoinDesk, NBC News, Hudson Rock analysis via BleepingComputer.