Polymarket has suffered a security breach after a malicious script linked to a third-party analytics tool compromised its international platform, resulting in approximately $2.6 million in unauthorized withdrawals from around 700 user accounts.
The attack reportedly involved DebugBear, a third-party monitoring tool whose compromised script was able to affect Polymarket’s international website. The malicious code enabled attackers to access user accounts and withdraw funds without authorization.
Following the discovery, Polymarket quickly switched its platform to cancel-only mode to prevent further unauthorized activity while its security team investigated the incident. The company subsequently addressed the issue, removed the compromised script and worked to restore normal platform operations.
Polymarket also promised to fully reimburse affected users for their losses. Trading resumed after the platform implemented the necessary fixes and completed its initial security response.
The incident triggered mixed reactions among Polymarket users. While many welcomed the platform’s quick response and reimbursement commitment, others criticized its reliance on third-party tools and raised questions about its security practices.
One trader also claimed to have suffered a substantial financial loss in the incident. However, questions emerged about the legitimacy of that particular claim after blockchain transaction data appeared to contradict parts of the account.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
The breach highlights the security risks associated with third-party scripts and external services integrated into cryptocurrency and online trading platforms. Even when a platform’s core infrastructure remains secure, compromised external tools can introduce vulnerabilities that expose users to financial losses.
