Polymarket’s Third Breach Since May Came Through the Side Door, Not Its Contracts

On Thursday, October 29, Polymarket put its international exchange into cancel-only mode and paused its relayer. By about 3 p.m. ET trading was back. In between, the company said that “one of our 3rd party providers was compromised,” that it had referred the matter to law enforcement, and that affected users “will be made whole.” That is nearly everything Polymarket has said. It has not given a total loss, a count of affected accounts, or the provider’s name.

This desk has not read Polymarket’s posts directly. The quotes here come from Unchained and Bitcoin.com News, which agree with each other on the wording.

Timeline

Per Unchained, which cites Polymarket’s posts and status page, all times Eastern: cancel-only mode and paused relayer actions at 2:05 p.m.; a post saying an issue on Polymarket.com had been fixed at 2:33 p.m.; a note that trading would restart around 3 p.m.; and the status page marked resolved at 3:05 p.m. The exchange was down for roughly an hour.

What the provider did, as reported

The mechanism comes from outside Polymarket, and it is secondhand. DeFiLlama’s pseudonymous developer 0xngmi told Bitcoin.com News that the attacker compromised a company that provides web-performance tracking, whose scripts were loaded on Polymarket, so visitors were exposed. 0xngmi said users’ seed phrases remained safe.

Unchained adds that security firm Hudson Rock described a script served from DebugBear’s servers that looked for users signed in to Polymarket, checked their holdings and tried to move them. DebugBear is a U.K. analytics company. Per Unchained, DebugBear said it was aware of an “ongoing security incident” and told customers of its real-user-monitoring product to remove its embed code. FinanceFeeds likewise cites later reporting naming DebugBear. Polymarket has not confirmed that name, and this desk did not find DebugBear’s own notice. Treat the link as reported, not established.

The loss figures

The spread is narrow but real, and the methods differ: one counts losses, one counts what sits in an address, one counts a fallback address named in the malicious code. FinanceFeeds notes that a wallet balance should not be read as a final total, and that the funds were swapped through USDC.e on Relay and moved on. Until Polymarket publishes a number, every figure here is an estimate.

Related Four Minutes After Initia’s USDC Reserve Hit $63, the Chain Halted

The pattern

Unchained counts this as Polymarket’s third incident since May, and notes that all three came through access points around the platform rather than a reported flaw in its trading contracts. In May, per Unchained, a compromised private key let attackers drain about $700,000 from an internal rewards wallet; FinanceFeeds describes the same episode as more than $660,000 in suspicious outflows and a possible internal-wallet key compromise, so the figure depends on who is counting. In June, per both outlets, a vendor compromise let attackers inject code into the site, and Bubblemaps estimated about $3 million was taken from fewer than 15 users.

Two of the three now involve third-party code running in the browser of a signed-in user. That is the detail worth sitting with.

What is not known

Not known from anything this desk read: how many users were hit, whether the script ran for hours or days before the halt, how funds moved beyond the swaps FinanceFeeds describes, and whether the attacker had a way to approve transfers or tricked users into signing them. Unchained also reports, citing Reuters, that the CFTC is investigating whether Polymarket kept U.S. users off its offshore market as a 2022 settlement required. Nothing reviewed ties that inquiry to this incident.