New reporting has put a victim count behind Polymarket’s third-party compromise. The Wall Street Journal reported that more than 700 accounts lost at least $2.6 million after malicious code associated with website-monitoring provider DebugBear reached Polymarket’s international users. wsj.com
Polymarket’s status history confirms that trading entered cancel-only mode at 18:05 UTC on 29 October, that the platform identified a compromised third-party provider at 18:37 UTC and that the incident was resolved at 19:05 UTC. Polymarket promised to reimburse affected traders and referred the matter to UK law enforcement.
DebugBear acknowledged an ongoing security incident and told customers using its Real User Monitoring product to remove the embedded code. Polymarket’s own status notice still does not name the vendor, publish a forensic report or confirm the reported victim and loss totals.
Researchers traced approximately $2.57 million in POL from a suspected attacker address to three additional wallets. The onchain movement supports the scale reported by independent outlets, but wallet balances alone cannot establish every user’s loss, reimbursement obligation or ultimate recovery.
This was a browser and dependency attack, not evidence that Polymarket’s prediction-market contracts failed. A user can approve or sign malicious transactions delivered through a compromised interface while the underlying blockchain and trading contracts continue operating.
TOKEN RECON ASSESSMENT
The incident now has a credible lower-bound scope, more than 700 affected accounts and at least $2.6 million reportedly drained. The unresolved operational question is whether every account has been reconciled and reimbursed. Polymarket should publish the injected-code path, exposure window, wallet-permission behavior, vendor controls and reimbursement completion. Until then, service restoration closes the outage, not the security case.
Sources
Polymarket official incident history
Wall Street Journal, victim and loss estimate
