Polymarket Traders Lose More Than $2 Million in Third-Party Supply Chain Attack

Cryptocurrency prediction market platform Polymarket has suffered a major security incident after malicious code associated with a compromised third-party website monitoring service was used to steal funds from traders.

The attack reportedly resulted in losses exceeding $2 million, with some blockchain investigations identifying approximately $2.5 million in potentially affected cryptocurrency assets.

Investigators linked the incident to DebugBear, a third-party website monitoring service whose JavaScript code was integrated into the affected platform.

Attackers reportedly manipulated the monitoring script to inject malicious JavaScript into the website. The code was designed to exploit active user sessions, allowing criminals to interfere with authenticated accounts without requiring victims to manually approve every malicious action.

Once executed, the malicious script could sell traders’ positions or transfer cryptocurrency tokens to attacker-controlled addresses.

The incident represents a supply chain security failure because the malicious activity originated through a trusted external service rather than a direct compromise of Polymarket’s core infrastructure.

The international Polymarket platform was reportedly affected, while its US platform remained unaffected.

Following the discovery, Polymarket temporarily halted trading, removed the malicious script, and began investigating the extent of the compromise. The company also pledged to reimburse affected users.

DebugBear acknowledged the security incident and advised customers to remove its website monitoring snippet while the investigation continued.

Blockchain security researchers identified suspicious transactions and traced cryptocurrency movements through multiple wallets and addresses associated with the attack.

The incident highlights the growing risks associated with third-party JavaScript integrations. Website monitoring tools, analytics services, advertising scripts, and other external components can introduce serious vulnerabilities when their infrastructure is compromised.

Security specialists warn that organizations must carefully monitor external dependencies, restrict third-party scripts, and implement stronger controls around authenticated sessions.

The attack also demonstrates how malicious code delivered through trusted services can potentially bypass traditional security protections and directly target cryptocurrency users.