Overview
- Polymarket placed its international platform into cancel‑only mode and paused relayer actions on Thursday while investigating reports of unauthorized withdrawals, then removed the compromised script and restored trading roughly an hour later.
- Security researchers traced malicious JavaScript served from DebugBear’s RUM CDN that checked for logged‑in users, liquidated positions or forged transfers, and hard‑coded a fallback attacker address used in more than 900 on‑chain transactions.
- Multiple blockchain analytics firms put the funds routed to the suspected attacker wallet at about $2.5–$2.7 million after swaps into POL and transfers to other addresses.
- Polymarket says its core smart contracts and backend systems were not breached, has pledged to fully reimburse affected traders, and has referred the incident to U.K. law enforcement while investigations continue.
- The incident reinforces a pattern of 2026 frontend and supply‑chain compromises at Polymarket and underscores calls for strict controls on third‑party scripts such as Subresource Integrity, content security policies, and tighter vendor vetting.