Polymarket Returns $3.9 Million After Hackers Hijack Third-Party Monitoring Script

The attack reached Polymarket through software supplied by another company. On October 29, hackers replaced a page-speed monitoring script with malicious code that sold some signed-in traders' positions and transferred their funds, according to The Hacker News.

The provider was DebugBear. It says its DNS records were compromised through its domain registrar, according to SecurityWeek. That account places the breach in the infrastructure used to deliver the script Polymarket loaded, rather than describing a direct break-in to Polymarket itself.

On October 29, Polymarket put its exchange into cancel-only mode after an exploit initially reported at $2.65 million, according to The Block. Existing orders could be canceled, but new buy and sell orders were blocked, The Defiant reported.

The interruption on the international platform lasted about an hour, according to NBC News. Polymarket also promised to fully reimburse affected users, Forbes reported that day. CNBC International reported that the exchange was referring the matter to U.K. authorities.

On October 30, SecurityWeek described malicious code linked to a website monitoring tool that was designed to hijack logged-in Polymarket sessions and siphon funds. That added detail to the company's initial account of a compromised third-party provider.

By November 1, The Hacker News put the theft at about $2.7 million and identified the hijacked script as DebugBear's. On November 2, SecurityWeek reported that Polymarket had returned $3.9 million to traders and that DebugBear's early findings indicated a single customer had been targeted.

The latest coverage moves the story beyond a reimbursement promise: SecurityWeek reports that $3.9 million has been returned. That is more than the approximately $2.7 million reported stolen by The Hacker News. The supplied coverage does not explain the difference or establish whether every affected trader has been fully repaid.

Polymarket also faces a separate regulatory inquiry. Before the breach, CNBC International reported renewed scrutiny over U.S. access to its offshore platform. Japan Times reported that the agency was examining customer-location controls and U.S. advertising. The coverage does not connect that inquiry to the security incident.

The immediate questions are whether reimbursement is complete and how the $3.9 million returned relates to the reported theft. DebugBear's account also remains preliminary: SecurityWeek describes its finding that one customer was targeted as an early result, not a final assessment.

Any further account from U.K. authorities could clarify the investigation. CNBC International reported the referral, but the supplied coverage gives no outcome.