--- title: Polymarket halts trading after crypto-draining script... description: Polymarket halted trading on Thursday after attackers compromised a third-party service to distribute cryptocurrency-draining JavaScript. The malicious script,... canonical: https://daily.dev/posts/polymarket-halts-trading-after-crypto-draining-script-breach-2-5m-traced-e7sqbmcgg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Polymarket halts trading after crypto-draining script breach, $2.5M traced | daily.dev og:description: Polymarket halted trading on Thursday after attackers compromised a third-party service to distribute cryptocurrency-draining JavaScript. The malicious script,... og:url: https://daily.dev/posts/polymarket-halts-trading-after-crypto-draining-script-breach-2-5m-traced-e7sqbmcgg og:image: https://api.daily.dev/og/posts/E7SqBMCGg.png og:image:alt: Polymarket halts trading after crypto-draining script breach, $2.5M traced og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Polymarket halts trading after crypto-draining script breach, $2.5M traced **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 4 min read · 0 upvotes · 0 comments ## Summary Polymarket halted trading on Thursday after attackers compromised a third-party service to distribute cryptocurrency-draining JavaScript. The malicious script, hosted on DebugBear infrastructure, hijacked authenticated Polymarket sessions to liquidate prediction-market positions and transfer assets to an attacker wallet. Roughly $2.5 million in assets was traced to a suspected attacker wallet, and trading resumed about an hour later. Polymarket says it will fully reimburse affected traders, while DebugBear told customers to remove its embed code and is investigating. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did the Polymarket crypto drainer attack actually work? Attackers compromised DebugBear, a third-party website performance monitoring service, and modified its Real User Monitoring JavaScript to hijack authenticated Polymarket trading sessions. The malicious script checked users' crypto balances and prediction-market positions, then either auto-sold positions or transferred tokens directly to an attacker wallet, using data.debugbear.com as a command-and-control server. _Teams relying on third-party scripts can follow supply chain breach writeups like this on daily.dev._ ### How much cryptocurrency was stolen in the Polymarket DebugBear breach? Roughly $2.5 million in assets was traced to a suspected attacker-controlled wallet. Blockchain analysis showed the wallet transferred approximately 28.6 million POL tokens, worth about $2.57 million, to three additional wallets, and separately held around $2.19 million at the time of investigation. _Developers tracking the scale and fallout of crypto security incidents can follow updates on daily.dev._ ### What should websites do if they use DebugBear's RUM monitoring script after this breach? DebugBear told customers to remove its monitoring embed code from their websites immediately, confirming it was investigating an ongoing security incident. At the time, DebugBear's own website was inaccessible and showing a Cloudflare error, and it was unclear whether that outage was tied to containment efforts. _Anyone auditing third-party script dependencies can track incident response details like this on daily.dev._ ## Similar posts on daily.dev - [Polymarket customers lose $3 million in supply-chain attack](https://daily.dev/posts/polymarket-customers-lose-3-million-in-supply-chain-attack-udeprymjt) · BleepingComputer · 0 upvotes · 0 comments - [Polymarket confirms hackers stole $3M from users after third-party vendor was compromised](https://daily.dev/posts/polymarket-confirms-hackers-stole-3m-from-users-after-third-party-vendor-was-compromised-xjgaqqwd9) · The Next Web · 0 upvotes · 0 comments - [Polymarket says hackers stole users' funds](https://daily.dev/posts/polymarket-says-hackers-stole-users-funds-t57t1dzov) · TechCrunch · 0 upvotes · 0 comments - [Newly created Polymarket accounts win big on well-timed Iran ceasefire bets](https://daily.dev/posts/newly-created-polymarket-accounts-win-big-on-well-timed-iran-ceasefire-bets-lrta7rsvh) · Hacker News · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#javascript](https://daily.dev/tags/javascript), [#polymarket](https://daily.dev/tags/polymarket) [View this post on daily.dev](https://daily.dev/posts/polymarket-halts-trading-after-crypto-draining-script-breach-2-5m-traced-e7sqbmcgg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Polymarket halts trading after crypto-draining script breach, $2.5M traced","url":"https://daily.dev/posts/polymarket-halts-trading-after-crypto-draining-script-breach-2-5m-traced-e7sqbmcgg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/polymarket-halts-trading-after-crypto-draining-script-breach-2-5m-traced-e7sqbmcgg"},"datePublished":"2026-10-29T21:51:17.665Z","dateModified":"2026-10-30T09:29:12.708Z","description":"Polymarket halted trading on Thursday after attackers compromised a third-party service to distribute cryptocurrency-draining JavaScript. The malicious script,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3c0d225d8d96025452c386aba9048073?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3c0d225d8d96025452c386aba9048073?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/polymarket-halts-trading-after-crypto-draining-script-breach-2-5m-traced-e7sqbmcgg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,javascript,polymarket","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Polymarket halts trading after crypto-draining script breach, $2.5M traced"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/polymarket-halts-trading-after-crypto-draining-script-breach-2-5m-traced-e7sqbmcgg#faq","mainEntity":[{"@type":"Question","name":"How did the Polymarket crypto drainer attack actually work?","acceptedAnswer":{"@type":"Answer","text":"Attackers compromised DebugBear, a third-party website performance monitoring service, and modified its Real User Monitoring JavaScript to hijack authenticated Polymarket trading sessions. The malicious script checked users' crypto balances and prediction-market positions, then either auto-sold positions or transferred tokens directly to an attacker wallet, using data.debugbear.com as a command-and-control server. Teams relying on third-party scripts can follow supply chain breach writeups like this on daily.dev."}},{"@type":"Question","name":"How much cryptocurrency was stolen in the Polymarket DebugBear breach?","acceptedAnswer":{"@type":"Answer","text":"Roughly $2.5 million in assets was traced to a suspected attacker-controlled wallet. Blockchain analysis showed the wallet transferred approximately 28.6 million POL tokens, worth about $2.57 million, to three additional wallets, and separately held around $2.19 million at the time of investigation. Developers tracking the scale and fallout of crypto security incidents can follow updates on daily.dev."}},{"@type":"Question","name":"What should websites do if they use DebugBear's RUM monitoring script after this breach?","acceptedAnswer":{"@type":"Answer","text":"DebugBear told customers to remove its monitoring embed code from their websites immediately, confirming it was investigating an ongoing security incident. At the time, DebugBear's own website was inaccessible and showing a Cloudflare error, and it was unclear whether that outage was tied to containment efforts. Anyone auditing third-party script dependencies can track incident response details like this on daily.dev."}}]} ```