Polymarket DebugBear Supply-Chain Frontend Attack

On October 29, 2026, Polymarket was hit for approximately $2.7 million after a compromised third-party monitoring vendor injected malicious JavaScript into the frontend of its international trading platform.

What happened

Polymarket said only that "one of our 3rd party providers was compromised." A person familiar with the matter told CNBC the entry point was a hack of DebugBear, a U.K.-based website performance monitoring company; DebugBear confirmed it was "impacted by an ongoing security incident." Hudson Rock found that a script loaded from DebugBear's Real User Monitoring infrastructure contained code targeting logged-in trading sessions, executing unauthorized transactions directly from the browser. The platform's smart contracts were never the point of failure. Blockchain analysts (Betting Intelligence, Polysights and Bubblemaps) counted roughly $2.7 million drained from about 700 wallets; the suspected attacker address held about $2.65 million in POL, Polygon's native token, after swapping the stolen assets. Polymarket's U.S. platform was not affected.

Aftermath

Polymarket put its international platform into cancel-only mode and paused trading for about an hour, resuming around 15:00 ET. It said affected traders "will be made whole" and that it was "fully reimbursing all affected traders," and referred the matter to U.K. law enforcement. The company has not disclosed a confirmed loss figure, a user count, or a reimbursement timeline.

Why it matters

This is Polymarket's second supply-chain frontend compromise of 2026, after the June frontend phishing attack that drained about $2.94M through a different vendor. The repeat underscores a structural weakness of non-custodial web apps: a single third-party script — analytics, monitoring, or a tag manager — loaded into a page that signs transactions becomes a direct path to user funds. As with the earlier incident, the contracts held; the browser did not. It reinforces the catalogue theme that frontend and third-party dependencies are now a primary attack surface, independent of on-chain code quality.