A compromised monitoring script drained $2.7m from Polymarket — $3.9m in refunds follows

On October 29, 2026, Polymarket's international website loaded a malicious replacement for a third-party performance-monitoring script. The injected code targeted users with active sessions, sold positions and moved funds from their wallets. Polymarket paused trading, removed the script, cleared caches, reset sessions and restored operations. Its October 30 postmortem reports $2.7 million in drained funds and an additional $1.2 million to compensate losses linked to the trading pause, for $3.9 million total reimbursement. It said 95% of affected wallets had already been refunded in full at the time of the update. Reuters independently identified performance-monitoring vendor DebugBear, which told its Real User Monitoring customers to remove the embed code while investigating a compromise.

A third-party JavaScript file included for performance telemetry can execute in the same page context as sensitive application code. When the vendor or its delivery pipeline is compromised, an attacker may exploit existing user sessions without stealing credentials or compromising the application's backend or smart contracts. The incident demonstrates that externally hosted analytics and monitoring scripts are part of the production trust boundary, especially in financial applications. Polymarket's postmortem supplies confirmed losses and operational changes rather than only speculative blockchain estimates.

Polymarket says attackers replaced a vendor-hosted performance-monitoring script with code designed for its users. During a limited window, the malicious code used logged-in sessions to sell positions and transfer assets. The platform does not attribute the intrusion to a smart-contract vulnerability. Reuters identified DebugBear as the vendor, and the vendor separately advised RUM customers to remove its embedded script. The precise path by which the vendor's script was altered remains under investigation.

The October 30 Polymarket status postmortem separates $2.7 million taken through the hack from $1.2 million in additional compensation for positions affected by the trading pause. It says the platform will return $3.9 million overall, and 95% of affected wallets had been refunded in full at the time of posting. The October 29 incident was marked resolved after the web app and account access experienced a major outage; the published 37-minute incident window should not be conflated with the complete period of malicious activity.

Polymarket removed the compromised script, cleared caches, paused trading and relayer actions, reset active login sessions and notified law enforcement. It says third-party scripts are being redeployed with stronger integrity controls, continuous verification, content security policy, explicit version pinning and sandboxing. These are planned or ongoing controls, not independently audited guarantees. Other site operators should inventory externally loaded scripts, restrict unnecessary third-party execution and monitor script changes.

This incident involved a currently used vendor's performance-monitoring script being replaced with malicious content. It is distinct from the DeadTag campaign in which attackers acquired expired domains still referenced by old script tags. Both show why scripts loaded from outside an application's own codebase deserve explicit trust and integrity review, but the entry paths and observed outcomes differ.