Do Son 
Source image: Unsplash.com
Decentralized prediction venue Polymarket faced a severe security incident on October 29, 2026. Specifically, an intrusion compromised a third-party analytics script to siphon customer balances illicitly. Consequently, platform administrators suspended new transactions to halt unauthorized fund movements. As reported in coverage by Reuters on the Polymarket trading outage, engineers quickly contained the breach and resumed exchange operations. Furthermore, corporate leadership pledged full financial restitution for verified losses.
Malicious Tampering in Website Performance Scripts
Preliminary forensic inquiries traced the digital compromise to DebugBear, an external monitoring provider. Historically, the company real user monitoring library measures client page load performance. However, attackers modified the hosted JavaScript library to execute offensive routines. DebugBear acknowledged the security anomaly and advised customers to purge the code immediately.
Security researchers at Hudson Rock dissected the 15,187-byte file harvested from the server. Rather than collecting performance metrics, the script sought active Polymarket sessions actively. According to an investigative breach report by InfoStealers, the hidden module intercepted wallet signing logic directly. Consequently, the routine parsed open portfolio balances and manipulated automated order placement.
EIP-712 Signature Forgery and Liquidation Schemes
The embedded payload operated with exceptional technical cunning. First, the script attempted to liquidate outstanding prediction positions into liquid tokens. Subsequently, it prompted users for Polygon EIP-712 cryptographic signatures. Because the prompt originated from the genuine domain, traders mistook requests for standard platform confirmations. Therefore, signing the message granted unauthorized contracts permission to drain available assets.
On-chain records demonstrate rapid fund aggregation following the initial script injection. Observers tracked suspicious transactions routing through the designated attacker wallet address on Arkham, which accumulated roughly 2.65 million dollars in POL tokens. Additionally, the adversary converted stolen USDC.e into alternative assets through the Relay bridge. Multiple individual traders reported substantial losses, including one account holder forfeiting 800,000 dollars.
Recurring Vendor Risks in Decentralized Finance
Alarmingly, this crisis mirrors an earlier security failure from recent months. Specifically, a similar vendor compromise drained platforms in late June. As documented in a CoinDesk retrospective on the June Polymarket breach, attackers previously siphoned 3.1 million dollars via tainted scripts. Consequently, the latest incident highlights persistent vulnerabilities within peripheral web dependencies.
Platform engineers permanently purged the compromised integration at 17:59 UTC on October 29. Furthermore, executives reported the criminal activity to British law enforcement agencies. Security specialists urge traders to inspect their token approvals and revoke lingering smart contract allowances. Ultimately, decentralized platforms must enforce strict script integrity controls to preserve customer trust.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
