Polymarket promises reimbursement after third-party compromise

Polymarket confirmed on October 29, 2026, that a third-party provider serving its international platform had been compromised, promising to reimburse affected users. The company marked the incident fixed at 19:05 UTC, after the exchange entered cancel-only mode and paused relayer actions during the investigation.

The operator identified and fixed the issue, referring it to relevant law enforcement. However, Polymarket provided no information about total losses, the number of affected accounts, or a reimbursement schedule.

Attack details

At 18:06 UTC, Polymarket's status account announced the exchange was in cancel-only mode with relayer actions paused. The compromise was confirmed at 18:33 UTC, with trading temporarily halted as the platform worked to restore service. Hudson Rock published research revealing wallet-draining code from a DebugBear script URL associated with Polymarket.

The code was designed to reach authenticated trading sessions, request signatures, and redirect assets. Hudson Rock's findings come from static analysis, not verified accounting of executed thefts. The researcher found production-build metadata recording removal of the DebugBear RUM script with a timestamp of 17:59:20 UTC.

Code mechanics

The malicious code read browser local-storage entries containing authentication context, deposit-wallet addresses, and trading API credentials. It distinguished between account types and checked for account data before proceeding. The sample searched for live trading clients with order-creation and submission methods, attempting to use the client and its signer.

The code had different paths for moving assets: batch transfers for externally owned accounts and sell orders at aggressive prices for non-EOA accounts. For wallet actions, it constructed signed batch messages for Polygon and attempted submission through Polymarket's relayer, with conversion and swap routes as fallbacks.

User response

Hudson Rock advised users to reject unexpected signing requests and close potentially exposed tabs. The researcher recommended checking recent orders, position movements, and wallet transactions through trusted routes, retaining timestamps and transaction hashes for anomalies.

Polymarket's API documentation separates authentication from authorization, with order placement requiring both API credentials and wallet signatures. The incident evidence doesn't establish that session keys were involved, though the compromised code sought broader signer access than session keys typically allow.

The initial compromise mechanism, first malicious delivery, and exact count of affected users remain unresolved. Polymarket hasn't provided aggregate loss figures or reimbursement timetables, and no independent on-chain loss accounting has been established.