Polymarket users lose $2.7 million in DebugBear-linked cyberattack: How it unfolded? What we know
Polymarket users lost an estimated $2.7 million in a suspected cyberattack linked to a breach at a third-party technology provider, prompting the prediction market to temporarily suspend trading on its international platform on Thursday. The company has since restored trading and pledged to fully reimburse users whose funds were taken.
The incident came to light after traders reported unauthorised withdrawals from their accounts. Polymarket said it had identified and fixed the vulnerability, adding that it had referred the matter to law enforcement in the United Kingdom, where DebugBear is based.
An official familiar with the investigation identified DebugBear, a UK-based website performance monitoring company, as the third-party provider involved, according to Wall Street Journal.
Polymarket initially halted trading on its international exchange, Polymarket.com, after detecting a security issue involving an external service provider.
Polymarket subsequently switched to a cancel-only setting, allowing users to withdraw existing orders but preventing them from placing new ones. Relayer operations, which facilitate transactions on the platform, were also suspended while the company investigated.
On trading platforms, cancel-only mode means that traders cannot place new orders to buy or sell a contract, but can still cancel outstanding orders.
Polymarket described the suspension as a precautionary measure. It later announced that the issue had been resolved and trading had resumed.
"We’ll make this right and are fully reimbursing all affected traders," the company said in a post on X.
DebugBear, which provides website performance monitoring and debugging services, acknowledged that it had been affected by an ongoing security incident.
The company advised customers using its Real User Monitoring (RUM) product to remove the embedded code from their websites. Its website was also reportedly inaccessible on Thursday afternoon.
DebugBear posted on X that it had been “impacted by an ongoing security incident” and advised customers who used one of its products to “remove the embed code from your website.”
According to researchers at cybersecurity firm Hudson Rock, a script served through DebugBear contained code designed to identify an active trading session belonging to a signed-in user. The script allegedly attempted to liquidate the user's holdings and transfer the proceeds to another wallet.
Researchers also said the code contained a cryptocurrency wallet address embedded as a destination for the stolen funds.
The precise circumstances that enabled the compromise, as well as the total number of affected accounts, remained unclear.
An analysis of blockchain transactions by The Wall Street Journal identified a wallet associated with a suspected attacker that appeared to have received more than $2.5 million from Polymarket users.
The funds were moved through more than 900 transactions. Data from blockchain analytics platform Arkham, cited by Decrypt, showed that the wallet held approximately $2.65 million worth of POL, the native token of the Polygon network.
Separately, DeFi Llama estimated the losses from Thursday's incident at approximately $2.7 million, putting the suspected theft close to the scale of an earlier breach involving the platform.
Thursday's incident is not the first time Polymarket users have suffered losses following a security compromise involving an external provider.
In May, approximately $700,000 was reportedly drained from an internal top-up wallet after its private key was compromised.
A separate incident in June involved malicious code being introduced into the platform's frontend through a compromised third-party vendor. The attack resulted in roughly $3 million being taken from fewer than 15 accounts. Polymarket subsequently pledged to reimburse affected users.
The latest breach raises fresh questions about the security risks associated with third-party services integrated into cryptocurrency trading platforms.
Sayantani Biswas is an assistant editor at Livemint with seven years of experience covering geopolitics, foreign policy, international relations and global power dynamics. She reports on Indian and international politics, including elections worldwide, and specialises in historically grounded analysis of contemporary conflicts and state decisions. She joined Mint in 2021, after covering politics at publications including The Telegraph. <br> She holds an MPhil in Comparative Literature from Jadavpur University (2019), with a specialisation in postcolonial Latin American literature. Her research examined economic nationalism through Eduardo Galeano’s Open Veins of Latin America. She also writes on political language, cultural memory and the long shadows of conflict. <br> Biswas grew up in Durgapur, an industrial town in West Bengal shaped by migration, which drew families from across India to the Durgapur Steel Plant. As the only child in a joint family, she spent years listening—almost obsessively—to her grandparents’ testimonies of struggle, fear and loss as they fled Bangladesh during the Partition of 1947. This formative exposure to lived historical memory later converged with her training in Comparative Literature, equipping her to analyse socio-economic structures and their reverberations. <br> Outside the newsroom, she gravitates towards cultural history and critical theory, returning often to texts such as Paulo Freire’s Pedagogy of the Oppressed. As a journalist, she is committed to accuracy, intellectual rigour and fairness, and believes political reporting demands not only clarity and speed, but historical depth, contextual precision, and a disciplined resistance to spectacle.
Catch all the Business News , Market News , Breaking News Events, JIO IPO Listing Today LIVE and Latest News Updates on Live Mint. Download The Mint News App to get Daily Market Updates.
HomeMarketsPolymarket users lose $2.7 million in DebugBear-linked cyberattack: How it unfolded? What we know
✕
Wait for it…
Oops! Looks like you have exceeded the limit to bookmark the image. Remove some to bookmark this image.