Polymarket halts trading after script breach and $2.5M loss

# Polymarket halts trading after script breach and $2.5M loss

https://gcdradar.vercel.app/incidents/polymarket-halts-trading-after-script-breach-and-2-5m-loss · AIR-2026-1656 · live

- Lane: Breaches & attacks
- Severity: 4 (Confirmed real-world loss): Confirmed real-world financial loss of approximately $2.5 million.
- Fix status: No fix needed
- First reported: 2026-10-29
- AI role: No AI role
- Products: Polymarket

## Summary

Polymarket suspended trading after attackers compromised a third-party service to inject cryptocurrency-draining scripts. Approximately $2.5 million in assets was traced to attacker wallets.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-11-02: Polymarket announces plans to refund $3.9 million to victims of the site compromise. (https://therecord.media/polymarket-returning-funds-to-customers-after-site-compromise)
- 2026-11-02: Third-party provider DebugBear confirms a DNS hijack via its domain registrar (https://securityweek.com/polymarket-returns-3-9-million-to-traders-as-debugbear-cites-dns-hijack)
- 2026-11-01: Polymarket confirms refunds for 726 affected wallets totaling approximately $2.7 million (https://thehackernews.com/2026/11/hackers-steal-about-27-million-from.html)
- 2026-10-29: Polymarket halts trading after crypto-draining script breach, $2.5M traced (https://bleepingcomputer.com/news/security/polymarket-halts-trading-after-crypto-draining-script-breach-25m-traced)

## Sources

- 2026-10-29 BleepingComputer: Polymarket halts trading after crypto-draining script breach, $2.5M traced https://bleepingcomputer.com/news/security/polymarket-halts-trading-after-crypto-draining-script-breach-25m-traced
- 2026-10-30 SecurityWeek: $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack https://securityweek.com/2-million-drained-from-polymarket-traders-in-new-supply-chain-attack
- 2026-10-30 The Record: Polymarket confirms cyberattack on third-party provider after outages https://therecord.media/polymarket-confirms-cyberattack-third-party
- 2026-11-01 The Hacker News: Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script https://thehackernews.com/2026/11/hackers-steal-about-27-million-from.html
- 2026-11-02 SecurityWeek: Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack https://securityweek.com/polymarket-returns-3-9-million-to-traders-as-debugbear-cites-dns-hijack
- 2026-11-02 The Record: Polymarket pledges to give $3.9 million back to victims after site compromise https://therecord.media/polymarket-returning-funds-to-customers-after-site-compromise

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.