A sophisticated software supply-chain breach drained 2.7 million USD from 726 user accounts on Polymarket after cybercriminals compromised an external performance monitoring vendor to inject rogue JavaScript directly into user web browsers.
By Elena Kowalski | November 8, 2026
What Happened
Traders on the popular prediction exchange Polymarket faced unexpected portfolio losses when unauthorized sell orders began emptying user balances across active accounts. Within approximately one hour, attackers siphoned roughly 2.7 million USD out of user balances before site engineers detected the anomaly and intervened.
The breach did not stem from a flaw in the underlying blockchain or the automated programs running the platform. Instead, attackers targeted a third-party analytics company named DebugBear, which provides website speed testing and real user monitoring tools. By tampering with that outside vendor’s internet routing settings, the hackers delivered malicious code to anyone visiting the trading portal.
For everyday investors, the incident serves as an urgent reminder that crypto safety involves more than just keeping secret passwords safe. Even when protocol foundations remain completely intact while Bitcoin trades steadily around 75,660 USD and Ethereum hovers near 2,230 USD, the websites used to manage holdings can become a primary point of failure.
- 2.7 million USD — total digital assets siphoned directly from victim accounts during the intrusion
- 726 user wallets — individual accounts compromised during the active attack window
- Under 60 minutes — the rapid timeframe in which attackers executed unauthorized liquidations
- 3.9 million USD — full compensation pool allocated by Polymarket to cover stolen funds and trade disruption
How the Attack Worked
To understand this intrusion, think of a bank whose vault doors are completely impenetrable, but an attacker replaces the teller window with a fake booth. The blockchain contracts—the digital vending machines that automatically settle trades without human middlemen—were never breached. Instead, the attackers pulled off a software supply-chain attack.
The attackers breached the domain registrar managing the internet address records of DebugBear. By altering these domain settings, the hackers hijacked the website script that Polymarket imported to measure page performance. When regular users logged into their accounts to trade, their web browsers automatically downloaded this tampered script alongside normal site components.
Once running inside an active browser tab, the rogue code took advantage of existing account permissions. It read temporary trading keys stored in the browser’s working memory, tapped into the live trading dashboard, and automatically dumped open positions at market prices. The script then transferred the proceeds straight into attacker-controlled addresses.
When I reviewed the on-chain transfer records from the incident, the evidence was clear: attackers never stole private keys or bypassed cryptographic locks, but instead hijacked active browser sessions to place unauthorized sell orders.
Who Is Affected
The exploit exclusively harmed users who had active, logged-in browser sessions open on the international web application while the compromised script was live. Passive token holders who held assets in offline hardware storage or disconnected software wallets experienced zero exposure.
A total of 726 user wallets suffered direct financial losses, with individual damages ranging from a few hundred dollars to tens of thousands of dollars. Beyond direct thefts, several thousand additional traders experienced secondary losses when unexpected sell floods triggered sudden price drops across specific prediction markets.
Because prediction markets depend on tightly balanced betting pools—shared piggy banks where participants take opposing sides on world events—the rapid dumping of positions by the malicious script temporarily warped market odds. This caused forced liquidations and slippage for adjacent traders who were not directly drained by the script itself.
What the Team Is Doing
Polymarket’s security team acted within an hour of the first fraudulent transfers by triggering emergency safeguards. Engineers switched the entire order book into cancel-only mode, halted automated trade relayers, and completely scrubbed the external DebugBear integration from the website code before freezing trading operations.
To protect customer trust, the platform announced a comprehensive reimbursement initiative. In addition to reimbursing the 2.7 million USD stolen directly from the 726 wallets, platform leadership expanded the compensation package to cover traders damaged by emergency market freezes and forced price drops, bringing total restitution to roughly 3.9 million USD.
Meanwhile, the vendor DebugBear regained control over its compromised account credentials, worked with external cybersecurity investigators to patch registrar controls, and confirmed that no internal customer databases were leaked. Polymarket stated it is implementing strict content security policies that prevent third-party scripts from executing unauthorized network calls.
How to Protect Yourself
While retail investors cannot control third-party vendor code, simple security hygiene can dramatically limit your risk when using digital finance applications. Treating your browser sessions with the same caution as an open bank terminal prevents automated scripts from accessing your funds.
The most effective defensive habit is logging out of trading websites as soon as your transactions are finished. Malicious session-hijacking scripts rely entirely on active credentials stored in browser memory; closing your active session cuts the digital cord.
Here are three straightforward habits to shield your portfolio against frontend supply-chain risks:
- Log out after every session — Never leave decentralized exchange tabs idling in the background on your computer or mobile device.
- Separate trading balances from savings — Keep only the capital you actively intend to trade in connected web accounts, keeping the rest in cold storage hardware wallets.
- Use dedicated browser profiles — Conduct financial transactions in a clean browser window stripped of third-party extensions, social media logins, and unverified plugins.
Elena Kowalski’s take
Treating frontend code as an afterthought while obsessing over smart contract security leaves the digital front door unlocked for ordinary users. My attention centers on whether Polymarket distributes the entire 3.9 million USD compensation package without denying contested user slippage claims. If secondary frontend vulnerabilities emerge across other major prediction platforms this month, my view that this was an isolated vendor failure will quickly change.
The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.
726 accounts drained in under an hour because a performance monitoring vendor got popped. third party js is such a weak link, we keep relearning this every year
^ exactly. everyone audits the smart contracts and then ships some random perf script with full page access. nobody audits the vendors
it wasnt even their servers, the routing got hijacked upstream of DebugBear. you can audit every vendor and still inherit your transit providers threat model
The uncomfortable part is the exchange itself worked fine the whole time. Funds were safe from the chain side but not from the code your own browser loaded.
2.7 million gone and not a single audit failed. makes you rethink where the actual risk lives
worse, a hardware wallet wouldnt have saved you. the injected js makes the page ask your wallet to sign the transfer and people approve what looks like the normal ui