On Oct 29 at ∼2:05 PM ET, users on http://Polymarket.com (international) reported wallets being drained. Polymarket put the exchange into cancel-only mode and paused its relayer that submits signed trades.
At 2:33 PM ET, Polymarket Traders account on X posted: "We've identified and fixed an issue... One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement. Anyone who has been impacted will be made whole."
The provider is DebugBear, a UK web-performance monitoring firm. DebugBear's RUM script embedded on Polymarket was hijacked to serve a crypto-draining JavaScript. Researchers at Hudson Rock found the script hijacked logged-in sessions, auto-sold prediction positions, and swapped USDC.e -> POL via Relay, funneling to wallet 0x3F99...fc18.
On-chain estimates: $2.5M-$2.7M stolen across ∼700-710 wallets, ∼900 transactions. Arkham tracked ∼28.6M POL (∼$2.57M) moved to 3 wallets. Some users claimed losses of hundreds of thousands.
Trading resumed around 3:05 PM ET after ∼1 hour, now fully online. Polymarket says US platform unaffected and "fully reimbursing all affected traders." It's the second frontend supply-chain breach this year after June's $3M incident.