Polymarket put its exchange in cancel-only mode and paused relayer actions on Thursday, October 29, after users reported funds leaving their accounts without permission. The company later confirmed that one of its third-party providers was compromised and said everyone impacted will be made whole.
Incident timeline
The whole episode, from first notice to resolution, lasted one hour, according to Polymarket's status page history.
Time (UTC) | Status | Message |
|---|---|---|
18:05 | Investigating | Exchange in cancel-only mode, relayer actions paused |
18:37 | Identified | Issue fixed; third-party provider compromised, referred to law enforcement |
18:55 | Monitoring | Trading to resume at approximately 3pm ET |
19:05 | Resolved | Incident marked as resolved |
In the 18:37 update, Polymarket said the issue affected its international platform, Polymarket.com, and that trading was halted "out of an abundance of caution". The company posted the same statement on X.
The script that drained accounts
Researchers at Hudson Rock downloaded cdn.debugbear.com/C7xcKKrjUnXK.js at 18:12:06 UTC and found a 15,187-byte payload containing wallet-draining logic, according to their published analysis. DebugBear is a web performance monitoring service.
The review found no routine that sends private keys, passwords or seed phrases to the attacker. Instead, the script reused the authority of the session already logged in to the browser:
- Read the local-storage entries polymarket.auth.params, polymarket.auth.proxyWallet and poly_clob_api_key_map
- Traversed React component internals to find the live trading client, looking for methods like postOrder and createOrder
- Calculated portfolio value and applied thresholds of 10 for total value and 10 per position
- EOA accounts: built an ERC-1155 batch transfer of position tokens to the recipient
- Magic accounts: submitted sell orders at increasingly aggressive prices, then transferred the proceeds
- Reported wallet address, IP, country, portfolio value and transfer results to data.debugbear.com
Polymarket's production code contains the build message "chore(polymarket): remove debugbear rum script (#15337)" with a timestamp of 17:59:20 UTC. Hudson Rock notes that a build timestamp does not establish the exact moment of deployment.
Reported losses and the recipient address
Trader Car (@CarOnPolymarket) said his account was drained of $800,000 and that all his positions were sold. The figure is the user's own report and was not verified on-chain by Hudson Rock.
The address 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18, hard-coded in the script as its fallback recipient, showed the following balances on PolygonScan at the time of the capture:
Asset | Value |
|---|---|
POL | $2,178,191.78 |
Other tokens | $16,170.39 |
Total | approx. $2.19M |
Hudson Rock says the balance should not be added to the $800,000 loss, since the two may overlap. The number of affected users, total losses and the initial compromise mechanism remain unknown.
What it means for you
If you had Polymarket.com open with an authenticated session during the incident, Hudson Rock recommends closing exposed tabs and reviewing recent orders, position movements and wallet transactions from a clean session.
- Reject any signing or approval request you did not initiate
- Review active sessions and API credentials using the platform's support guidance
- Disconnecting a wallet does not reverse completed transfers or revoke on-chain approvals
- Avoid "recovery" links from unsolicited accounts and never share your seed phrase