Overview
- Polymarket put its international site into cancel-only mode and paused relayer actions on Oct. 29 while it investigated, fixed the issue and resumed trading after about an hour, and the company said it will reimburse affected users and has referred the case to UK law enforcement.
- Blockchain analysts traced multiple USDC.e-to-POL swaps routed through Relay into a suspected attacker wallet that now holds about $2.65 million in POL and has been identified in public analyses as 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18.
- Security researchers at Hudson Rock reported that a DebugBear-hosted performance script contained code that seeks logged-in trading sessions, tries to sell positions and transfers assets, and includes a hard-coded fallback recipient address.
- The incident highlights a recurring supply-chain risk for Polymarket: earlier 2026 breaches involved an internal POL wallet compromise in May and a June frontend supply‑chain attack that drained roughly $2.9–3.1 million, showing that audited smart contracts do not stop malicious frontend scripts.
- Users should avoid signing unexpected wallet prompts as investigators continue on-chain tracing and recovery efforts, and observers will watch for law-enforcement progress, DebugBear or vendor disclosures, and any wider impact ahead of the U.S. midterm betting surge.