On-chain investigation data shows that an address suspected of belonging to the Polymarket attacker converted the stolen funds into POL tokens worth approximately $2.65 million, then transferred out a total of 28.64 million POL in multiple transactions. The fund-mixing activity is ongoing, making on-chain tracking considerably more difficult.
This attack was a third-party supply chain compromise. Hackers used a tampered DebugBear monitoring script to inject malicious code that stole session credentials and API keys when users visited the page, automatically sold users’ prediction market positions, and transferred out their assets. Nearly a thousand user accounts were affected. Polymarket has confirmed the source of the vulnerability, shut down the at-risk service, and pledged to fully compensate affected users. It has also referred the case to law enforcement.
Looking at the flow of funds, the attacker first converted the stolen USDC and USDC.e stablecoins into POL, then split the funds into large transfers. Market analysts believe that converting the funds to POL before transferring them in batches is a typical money-laundering tactic used by hackers. The aim is to evade stablecoin issuers’ one-click freeze mechanisms and reduce the likelihood of the assets being intercepted. So far, no large-scale transfers of this POL to exchanges have been observed, and the funds’ destination remains under observation.
Security researchers warn that this is the second similar front-end supply chain attack on Polymarket in the past six months. The platform’s smart contracts were not compromised; the risk was concentrated in third-party embedded scripts. These attacks are highly stealthy, making it difficult for users to tell whether pop-ups and signature requests are native platform interactions. If this POL continues to flow to centralized exchanges, it will create selling pressure on POL. If it continues to be split and moved among multiple wallets, tracing the funds will take even longer. Supply chain attacks on crypto assets are difficult to guard against. High-frequency traders are advised to regularly revoke approvals and avoid staying logged in to the website for extended periods.
