Polymarket resumed trading operations on October 29 following a security incident involving a compromised third-party provider that disrupted its global prediction market platform. Earlier, on June 25, a website-script attack reportedly drained approximately $3 million, raising serious concerns about the potential reach of external code within a user’s browser environment.
The timeline indicates trading restrictions from 18:05 UTC on October 29, lasting roughly one hour. According to the company’s incident report, the issue was resolved, law enforcement was notified, and affected users will be compensated.
The vulnerability extends beyond substituting a compromised vendor, as separate investigations revealed malicious code capable of accessing financial functions directly within the user’s browser. June’s breach exploited approved authorizations, while October’s attack targeted trading tools and required cryptographic signatures for execution.
Two Scripts, Divergent Attack Vectors
On June 25, Polymarket identified a malicious script injected via a compromised vendor. Following an investigation by Source Defense, the affected dependency was removed, and users were promised full refunds.
Source Defense reported that approximately $3 million was drained, tracing the attack through a marketing tag that loaded an external identity library. The attacker replaced this library with a Polymarket-specific malware that selectively targeted wallets exceeding $100,000 in value. The payload repeatedly requested digital authorizations, which, once approved, were processed through Polymarket’s relayer infrastructure—responsible for executing signed actions.
October’s malware was retrieved from a URL associated with DebugBear. Analysis by Hudson Rock revealed the script searched for active trading clients and their associated signers, the components responsible for requesting cryptographic authorizations. The code was programmed to execute different actions based on account type: transferring position tokens in one path or facilitating asset sales and proceeds transfers in another. Hudson Rock also discovered metadata indicating the removal of the DebugBear monitoring script post-deployment.
Static analysis conducted by Hudson Rock failed to confirm certain attack outcomes, including silent signature execution, private key theft, and a complete trail from victims to recipients. Additionally, the removal metadata leaves the exact end of user exposure unresolved.
Security Implications of External Code Access
According to MDN’s browser documentation, third-party scripts embedded in a webpage can access other scripts and data within the same page. While hosting such scripts externally does not inherently restrict this access, cross-origin content embedded in isolated frames presents a different security boundary.
Both the June marketing dependency and October’s monitoring-associated script were deployed through distinct delivery mechanisms but successfully breached sensitive interfaces.
Mitigating risks requires a multi-layered approach: minimizing external code, limiting signing requests, and verifying downloaded scripts. Removing non-essential integrations from trading and signing environments reduces the attack surface. Restricting signer access and enforcing stricter confirmation requirements for critical financial actions further limits potential exploitation. Subresource Integrity (SRI) allows browsers to validate script checksums against pre-defined fingerprints, enabling rejection of tampered content even from trusted domains.
Transparency remains critical. A comprehensive postmortem detailing the exposure window, affected accounts, and authorization pathways would aid in risk assessment. The unresolved question is whether another compromised integration could transform interface access into actionable financial exploitation.
Blockchain analytics firm Bubblemaps estimates over 700 Polymarket users were impacted in the October breach, with approximately $3.46 million in assets compromised. Attackers converted roughly $2.7 million into POL tokens and transferred them, while $750,000 remained on the platform at the time of analysis.
_20260101112329999_0153db.webp?w=1024&resize=1024,1024&ssl=1 "PKR Edges Up Against USD Amid Mixed Global Currency Trends")
