Polymarket Frontend Compromise Drains $2.6M in POL

Steady attention without excessive speculation.

Polymarket confirmed the breach on its status page at about 18:37 UTC. According to the update, one of its third-party providers was compromised, so attackers pushed unauthorized activity through the legitimate polymarket.com site. Importantly, the smart contracts themselves were never broken.

What Happened on Polymarket

The trouble started quietly on 29 October. Soon after 17:10 UTC, an attacker wallet began receiving POL on the Polygon network. Within minutes, users flagged strange activity on the Polymarket Discord.

By 17:45 UTC, trader @CarOnPolymarket posted a public warning. He said attackers drained $800,000 from his account, and a friend lost another $600k. Then he urged everyone to lock down their accounts and avoid the site.

Because the exploit ran inside the real website, many victims saw no obvious warning. For email and Magic-wallet users, the script often sold open positions without any prompt at all. As a result, some traders watched balances hit zero before they understood why.

How the Polymarket Frontend Compromise Worked

On-chain analysts and the DefiPrime technical breakdown traced the attack to a hijacked DebugBear monitoring script. DebugBear supplies a Real User Monitoring tool, and Polymarket embedded it on the frontend. After the compromise, that trusted script turned into a browser-side drainer.

A frontend compromise means the page you see gets altered, even though the blockchain underneath stays safe. Here, the swapped script ran directly in the browser. So it could read session data, find the trading client, and act as the user.

From there, the script sold positions through the order book in a fast fill-and-kill style. For external wallets, it also crafted token transfers through Polymarket’s gasless relayer. Then it routed the proceeds into POL on Polygon. Because the session authorized each action, the contracts simply executed as designed.

DebugBear acknowledged the problem at about 18:00 UTC. The company posted that it faced an ongoing security incident, and it told customers to remove the RUM embed code immediately. Minutes earlier, Polymarket had already pushed a commit that stripped the script from its bundle.

On-Chain Trail Points to One Wallet

The on-chain record tells a tight story. The primary attacker address on Polygon is 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18. It received its first POL at 17:10:23 UTC, in block 96,392,296.

By 18:19 UTC, the wallet held about 28.6 million POL, worth roughly $2.64 million at the time. Analysts counted around 47 distinct senders feeding the address, a mix of victims and infrastructure. Many transfers moved outcome tokens from the Conditional Tokens contract before swaps into POL.

For now, the funds sit mostly on Polygon. Early reports show no confirmed bridges, mixers, or exchange deposits yet. Still, the final loss total stays unconfirmed, since user reports and full on-chain attribution do not yet match cleanly.

Polymarket Halts Trading and Pledges Refunds

Polymarket moved fast once the drain surfaced. From about 18:05 UTC, the exchange entered cancel-only mode and paused relayer actions. Soon after, it halted trading entirely while it investigated.

The 18:37 UTC status update set out the official position. “We have identified and fixed the issue impacting our international platform, Polymarket.com,” the company wrote. It added that it referred the matter to law enforcement, and it promised that anyone impacted will be made whole.

That pledge matters, because Polymarket sits at record scale right now. Its US arm reported roughly $10 billion in volume during October 2026, and the global platform carries about $360 million in total value locked. Meanwhile, prediction-market activity keeps climbing ahead of the U.S. midterms.

A Repeat of the June 2026 Attack

This is the second frontend incident at Polymarket in roughly four months. Back in June 2026, a third-party vendor compromise also injected malicious JavaScript into the site. That attack drained close to $3 million in pUSD from about 11 wallets, and Polymarket pledged full refunds.

The pattern now looks familiar, and critics have noticed. Each time, the contracts held, yet a trusted outside script became the weak link. Consequently, some users question how a market this large still leans on so many third-party dependencies.

Polymarket is not alone on this front. Earlier the same week, rival prediction market Predict.fun reported a separate third-party issue that cost users around $400,000. Together, the two events sharpen a wider worry about supply-chain risk across crypto apps.

What Polymarket Users Should Do Now

First, avoid polymarket.com until the team confirms a full all-clear. Next, check your account activity and open positions once access returns safely. If anything looks wrong, document it for any future reimbursement claim.

Also, revoke stale token approvals as a precaution. Tools like revoke.cash let you remove high allowances granted to contracts. This step is standard hygiene after any incident, even when a frontend script, rather than a classic approval phish, caused the damage.

Finally, treat early loss figures with care. On-chain data shows roughly $2.6 million pooled so far, while the $800k and $600k claims come from one trader’s post. Official victim counts and a detailed post-mortem are still pending. This is not financial advice, so verify every claim before you act.

What Comes Next for Polymarket

Polymarket now faces two jobs at once. It must bring trading back online safely, and it must deliver on the promise to make users whole. The reimbursement process and timeline remain unconfirmed as of about 18:45 UTC on 29 October.

The bigger test is trust. After a second script attack in four months, Polymarket will likely face pressure to audit and reduce its third-party dependencies. For a market built on predicting outcomes, its own next move is the one users will watch closest.