Image Credit: Shutterstock
- Polymarket restored its international trading early on October 30 after a brief security disruption.
- A third-party security breach involving compromised monitoring code caused the temporary trading platform halt.
- Polymarket pledged to reimburse affected traders while total financial losses remained undisclosed.
Polymarket restored international trading early on Oct. 30 IST after a third-party security breach prompted an approximately one-hour disruption. The company pledged to reimburse affected traders.
The incident affected Polymarket’s international platform; while its separate U.S. platform was unaffected.
Trading Returns After Precautionary Halt
Polymarket initially restricted trading to order cancellations and paused relayer actions, which help submit blockchain transactions. Its status history first recorded the restrictions at 11:35 p.m. IST on Oct. 29.
At 12:07 a.m. IST on Oct. 30, Polymarket had fixed the issue affecting its international website. The company attributed the incident to a compromised third party and stated that it was working with relevant law enforcement authorities.
The incident was marked resolved at 12:35 a.m. IST. Polymarket’s status page subsequently showed its trading, account and settlement services as operational.
Researchers Identify Malicious Monitoring Code
Security researchers at Hudson Rock identified malicious JavaScript associated with DebugBear’s monitoring infrastructure. BleepingComputer’s analysis found that the code was designed to exploit authenticated user sessions and attempt unauthorized asset transfers.
Depending on the access available, the script could attempt to sell prediction-market positions or transfer tokens. Hudson Rock also identified production-build information indicating that Polymarket had removed its DebugBear monitoring integration.
DebugBear acknowledged a security incident and urged customers using its real-user monitoring service to remove the embedded code. Polymarket’s own incident notice attributed the breach to a third party without naming the provider.
Reimbursement Pledged as Losses Remain Unclear
Polymarket cleared anyone affected would be made whole. The pledge accompanied its explanation that the trading halt was a precaution while the platform addressed the incident.
BleepingComputer traced approximately 28.6 million POL tokens, valued at about $2.57 million, moving from a suspected attacker-controlled wallet to three other wallets. Those transfers were identified through blockchain analysis; the publication did not establish them as the incident’s total losses.
Polymarket has not disclosed a total loss, the number of affected traders or details of the reimbursement process.
