Overview
- Polymarket paused its international, wallet‑based exchange on Thursday after users reported unauthorized withdrawals and restored trading roughly an hour later.
- Security researchers obtained the malicious JavaScript and linked it to DebugBear’s Real User Monitoring script that had been embedded in Polymarket’s frontend and was removed by the company.
- Blockchain analysts traced roughly $2.5–$2.7 million flowing through hundreds of deposit wallets into a suspected attacker address after funds were converted into POL and moved on‑chain.
- Polymarket suspended relayer actions, put the site into cancel‑only mode, pledged to fully reimburse affected traders, and referred the incident to UK law enforcement.
- This repeats a June frontend supply‑chain compromise at Polymarket and highlights how vendor scripts running in users’ browsers can reuse authenticated sessions to move crypto without touching private keys.