Polymarket Script Breach: What Traders and Site Owners Should Do

A hacked outside tool put a money-stealing script on Polymarket. Here is how it worked and the simple steps to take now.

AppWT Informative Multi-Lingual System

On October 29, the prediction market Polymarket paused trading after a hidden script tried to take money from users. If you use Polymarket, check your account and follow only the company's official updates. If you run a website, review every outside tool that adds code to your pages.

What happened

According to BleepingComputer, Polymarket said one of its third-party providers was hacked. A third-party provider is an outside company whose tool a website uses. The hackers used that provider to spread a harmful script on Polymarket's international site, Polymarket.com.

Polymarket confirmed the problem. It said it found and fixed the issue. It also said it sent the case to law enforcement. The company said, "Anyone who has been impacted will be made whole." In plain terms, it plans to pay back people who lost money.

Here is the timeline on October 29, in Eastern Time:

• 1:50 to 1:56 p.m.: A suspected attacker wallet made many transactions tied to Polymarket's token contract. A wallet is a digital account that holds cryptocurrency.
• 1:59 p.m.: A Polymarket build showed a commit message about removing the DebugBear script.
• 2:05 p.m.: Polymarket put its exchange in cancel-only mode.
• 2:37 p.m.: Polymarket said the issue was fixed and paused trading out of caution.
• 3:05 p.m.: The incident was marked resolved, and trading was fully back online.

How the trick worked

The harmful code was written in JavaScript. JavaScript is a type of small program that runs in your web browser when you open a web page. Many websites load scripts from outside services to add features.

Researchers at Hudson Rock found the bad script. It was stored on servers that belong to DebugBear. DebugBear is a service that helps websites track how fast their pages load. Its Real User Monitoring tool works by placing a script on a website. That script collects speed details from visitors' browsers.

BleepingComputer studied a copy of the bad script. It found the script was built to do three things:

• Take over logged-in Polymarket trading sessions.
• Sell off users' prediction-market positions.
• Move cryptocurrency and other assets out of users' accounts.

DebugBear said it was dealing with an ongoing security incident. It told its customers, "If you use our RUM product, please remove the embed code from your website." Embed code is the small piece of code a website adds to use a tool.

How much was taken

The exact loss is not known yet. Polymarket has not said how many users were affected. It has not said how much cryptocurrency was stolen. It also has not explained how the payback process will work.

Outside researchers have shared some numbers, and they measure different things:

• About $2.5 million in assets was traced to a suspected attacker wallet.
• BleepingComputer found that this wallet sent about 28.6 million POL, a type of cryptocurrency, to three other wallets. That was worth about $2.57 million.
• Hudson Rock said the wallet held about $2.19 million when it checked.

Who is at risk

Two groups should pay attention:

• Polymarket users. The script was built to act on logged-in sessions. Anyone who used Polymarket.com on October 29 should check their account.
• Website owners who use DebugBear. DebugBear asked customers of its monitoring tool to remove its code.

The bigger lesson is simple. A website can be harmed through a tool it trusts, not only through its own code.

Other news this week shows a similar idea. The Hacker News reported that Alpine Linux upgraded its GitLab server, a tool for storing and building code. The flaw stayed open. The fix was in Ruby, a part that GitLab depends on. Alpine said, "upgrading GitLab is not enough."

What to do now

If you use Polymarket

1. Log in by typing the address yourself. Do not use links in emails or texts.
2. Check your positions, balance and recent activity for anything you did not do.
3. Follow updates only from Polymarket's official website and official accounts.
4. Be careful with anyone who contacts you offering to "recover" your money. Never share your password, login codes or wallet recovery words.

If you run a website

1. Check whether your site uses DebugBear's Real User Monitoring. If it does, remove the embed code, as DebugBear asked.
2. Make a list of every outside script your site loads. Remove any you no longer need.
3. Ask your web developer to check your site for scripts you do not recognize.

If you think you were hit

1. Write down what you see: dates, times, amounts and any missing positions.
2. Take screenshots of your account activity.
3. Contact Polymarket only through its official website.
4. Watch for the company's details on how it will pay back affected traders.

Have a question about anything here? Email me at sales@appwt.com or call (888) 565-0171, and I will answer it.

Sources

• Polymarket halts trading after crypto-draining script breach, $2.5M traced, BleepingComputer, 2026-10-29
• Attacker Tried to Exploit Alpine Linux's GitLab via CVSS 10.0 Flaw Its Ruby Left Open, The Hacker News, 2026-10-29