Polymarket vendor compromise: injected script drains roughly $2.7 million from user wallets
Polymarket, the crypto prediction market, briefly halted trading after a malicious script planted through a compromised third-party vendor began draining funds from user wallets. On-chain monitoring by Bubblemaps puts the losses at roughly $2.7 million across about 700 users, figures the company has not confirmed. Trading has since resumed, and Polymarket says affected users will be reimbursed.
A trusted front end turned hostile
According to reporting citing Wall Street Journal sources and blockchain security researchers, a script served by a website performance monitoring provider was altered to single out visitors with an active, signed-in trading session. Researchers at Hudson Rock said the code was built to liquidate holdings and forward the proceeds to an attacker-controlled address embedded in the script. An official cited by the Journal identified DebugBear, a UK-based website performance monitoring firm as the provider involved; the company said it had been impacted by a security incident and urged customers to remove its embed code. That attribution remains a reported suspicion rather than a confirmed finding, though Polymarket has said its own site was not breached. The drain itself was mapped by Bubblemaps, whose analysts estimated that roughly $2.7 million was pulled from about 712 deposit wallets before the flow was cut. The stolen funds were converted into POL, Polygon's native token, and dispersed across a chain of addresses. Polymarket has not confirmed the monitoring figures, and the same on-chain work found that one widely shared claim of an $800,000 personal loss did not hold up, because the wallet's withdrawal pattern differed from that of the other victims."We'll make this right and are fully reimbursing all affected traders."That promise came as the exchange worked through the incident in stages: first a cancel-only mode in which open orders could be withdrawn but no new trades placed, then a suspension of its transaction submission service, and finally a full restoration of trading. Polymarket referred the matter to law enforcement in the United Kingdom, where the vendor is based, and said Polymarket US, the separately regulated American platform, was unaffected.
Second vendor-origin compromise of the year
For Polymarket this is the second compromise of 2026 to originate with a supplier rather than with its own infrastructure. In June, the company disclosed that a third-party vendor had been compromised, injecting a malicious script into its frontend for some users. Stolen PUSD, Polymarket's settlement token, was bridged from Polygon to Ethereum and swapped into roughly 1,893 ETH, a haul estimated at $2.94 million. That earlier drain touched a far smaller group, somewhere between eleven and fifteen accounts, but it followed the same logic: code arriving over a trusted channel and executing inside the pages of a site users had no reason to doubt. A May incident, in which about $700,000 was drained from an internal top-up wallet through a compromised private key, sits outside that vendor pattern. It points in the same direction all the same: the security of user funds on a trading platform extends well beyond the platform's own perimeter.Why front-end supply-chain attacks work so well
A legitimate domain with years of history can serve hostile code for hours before anyone notices, and no phishing warning will fire, because nothing on the page is fake. The padlock, the bookmark, the correct spelling of the address all still say trust me. Both Polymarket incidents used exactly that trust as the attack surface, which is what separates this class of attack from ordinary phishing and makes it harder to spot in the moment.- Keep only small balances in browser-connected hot wallets and treat them as spending money, not savings.
- Prefer hardware wallets or wallet guardrails that simulate transactions and flag unexpected approvals before they are signed.
- Review standing token approvals periodically and revoke whatever is no longer needed.
- When a platform announces a front-end or vendor compromise, sign out, end other sessions, and treat anything signed during the incident window as worth re-checking.