Polymarket Halts Trading After Wallet-Draining Code Found in Third-Party Script

Polymarket halted trading and paused its relayer after a security incident it attributed to a compromised third-party provider. Existing orders could still be canceled, but new buy and sell orders were blocked. The platform subsequently said the issue had been fixed and pledged to make affected users whole, while trading remained halted as it worked to restore service.

Hudson Rock reported finding wallet-draining logic in a third-party JavaScript file associated with Polymarket’s DebugBear performance-monitoring integration. Static analysis indicated the payload accessed active account context, located the trading client and signer, and attempted to transfer position tokens or sell positions and redirect proceeds. Production build metadata showed the integration had been removed, but the exposure window and complete containment were not independently established. A trader reported an $800,000 loss, and a separate screenshot showed approximately $2.19 million at a fallback recipient address; neither total losses nor individual victim-to-recipient transfers were independently verified. The attacker, initial compromise mechanism and number of affected users remained unknown, with no evidence establishing a wider compromise of DebugBear customers.