Malicious code on the website of prediction market Polymarket sold some signed-in traders' positions and moved their funds to the hackers on October 29. The code had replaced a page-speed script that the site loaded from an outside company. Polymarket says it is refunding about $2. 7 million to 726 affected wallets.

Blockchain records show crypto worth about $2. 64 million reached the hackers' wallet in under an hour. The replaced script came from DebugBear, whose real user monitoring (RUM) tool measures how fast web pages load for real visitors.

Researchers at Hudson Rock downloaded the malicious file on October 29 from the address Polymarket's site used to load the DebugBear script. They also found a change in Polymarket's site code that removed the DebugBear script. DebugBear's DNS records were compromised through its domain registrar, the company said on X.

Its early findings indicate the attack targeted one customer's website. It has seen no sign of a break-in to its own systems, though it is still looking. The code reuses the access a signed-in trader already has in an open Polymarket page, Hudson Rock found after reviewing the file without running it.

It reads account details that Polymarket keeps in the browser, including a set of trading API keys. Those API keys alone cannot place an order on Polymarket, because orders also need a wallet signature.

Hudson Rock found no part of the code that sends the keys, a password, a seed phrase, or a private key to the server it reports to. Instead, the code searches the page for the part of Polymarket's site that places orders, and for the signer that approves the account's transactions. It then takes one of two paths.

For accounts that sign in with their own crypto wallet, it moves the trader's positions straight to the hackers' wallet. For accounts that sign in via email, it sells positions at ever-worse prices and then moves the money out.

In both paths, the code asks the account's own signer to sign its requests and hands them to Polymarket's relayer, which submits them. Hudson Rock said a signing request alone does not prove a trader signed without seeing a prompt.

The wallet provider may still ask the trader, refuse, or apply its own rules for the session. The company said it removed the script "within the hour." It also cleared every cache, reset all active login sessions and paused trading until the site was clean. It has referred the case to law enforcement.

By October 30, 689 of the 726 affected wallets had been refunded in full, and the remaining 37 were being paid as they were checked. Polymarket is also paying $1. 19 million to about 5,500 wallets that lost money during the trading pause or had positions taken. In all, it is returning $3. 9 million to traders.

Traders do not need to file a claim. Polymarket's status page links a form for anyone who thinks their amount is wrong or that they should have received a payment. DebugBear has told customers of its RUM product to remove its embed code from their websites. The address that served the malicious file, cdn. debugbear[.]

com, had no DNS record when The Hacker News checked on November 1. Hudson Rock's advice for sites that load outside scripts: Hudson Rock's advice for traders is to reject any signing request they did not expect.

Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities.

Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar.