On October 29, 2026, Polymarket's website served code that was not its own. A page-speed script from DebugBear, loaded by Polymarket's pages to measure how fast pages opened for visitors, had been replaced with malicious code. Within under an hour, about $2.64 million in crypto reached the attackers' wallet. The total loss came to about $2.7 million, spread across 726 wallets.
What sets this apart from the Binance and b14g hacks of the same week: the attackers did not break into Polymarket's vault. They hijacked a script supply line. DebugBear says its DNS records were compromised through its domain registrar, and the attack targeted one customer's website. Earlier that day the normal script was still served from Google Cloud Storage; by 18:13 UTC a different server was answering for DebugBear's web addresses. Only Polymarket's copy was swapped, because each customer loads its own copy.
How the code took the money
Researchers at Hudson Rock took the malicious file apart without running it. The code reused access already held by a trader signed in on an open Polymarket page. It read account details Polymarket keeps in the browser, including a set of trading API keys. Those keys alone cannot place an order, because orders also need a wallet signature.
So the code looked for the part of Polymarket's site that places orders, and for the signer that approves the account's transactions. It then asked the account's own signer to sign its requests and handed them to Polymarket's relayer for execution. For accounts signed in with their own crypto wallet, positions moved straight to the attackers' wallet. For accounts signed in by email, positions were sold at worsening prices and the money moved out. The wallet written into the code received its first funds at 17:10 UTC and its last at 18:02 UTC: 28.6 million POL tokens from 33 wallets, worth about $2.64 million at 18:19 UTC at DefiLlama's price of $0.0922. That figure counts only the POL, not positions moved alongside it.
One nuance from Hudson Rock matters: a signing request alone does not prove a trader signed without seeing a prompt. The wallet provider may still ask, refuse, or apply its own session rules. So this is not a story about wallets leaking seed phrases. No part of the code sent keys, a password, a seed phrase, or a private key to the attackers' server, Hudson Rock found.
The response and the refunds
Polymarket posted its first status update about unauthorized activity in user wallets at 17:38 UTC. At 18:05 UTC the exchange went into cancel-only mode and relayer actions were paused. The company says it removed the script "within the hour", cleared every cache, reset all active login sessions, and paused trading until the site was clean. The case was referred to law enforcement.
By October 30, 689 of the 726 affected wallets had been refunded in full, and the remaining 37 were being paid as each was verified. Polymarket is also paying $1.19 million to about 5,500 wallets that lost money during the trading pause or had positions taken. In all, it is returning $3.9 million. Traders do not need to file a claim; Polymarket's status page links a form for anyone who thinks their amount is wrong or that they should have received a payment.
What changed afterwards, and the lesson for traders
Polymarket says third-party scripts are coming back with extra checks: a stronger Content Security Policy (CSP), pinned versions, and sandboxing. DebugBear told customers of its real-user-monitoring product to remove its embed code, and by November 1 the address that served the malicious file had no DNS record.
Hudson Rock's advice for sites: keep unneeded third-party code off pages where users trade or sign, and where a file can be pinned, use Subresource Integrity so the browser rejects a file whose contents changed. The advice for traders is shorter: reject any signing request you did not expect. The same lesson applies on testnets and mainnets alike, and we have added a note about it to our testnet guide. The week's pattern also matches the b14g hack: fake refund and claim pages appear within hours, so any claim outside Polymarket's official channels should be treated as suspect, as in our b14g article.
Sources: The Hacker News (Nov 1, 2026), Stocktwits/TradingView (Nov 1, 2026), hacks.gr (Nov 1, 2026), Newisty (Nov 1, 2026). Figures are snapshots at writing time, early November 2, 2026 WIB, and can change.
Writing about crypto and Super Intelligence: market news, new projects, Super Intelligence models, and early opportunities like airdrops and testnets. Every piece starts from the official announcement, with the costs worked out up front.