Zero Radar
← feed
CriticalSecurity incidentupdated 1 Nov 2026, 07:55 UTC

Polymarket site hijacked via third-party script, draining trader funds

Attackers slipped malicious code into the Polymarket website through a outside service. While signed-in users used the site, their funds were moved to attacker wallets.

Attacks reported (BleepingComputer, SecurityWeek)5 independent sources
SeverityCriticalSecurity incident
Being exploited?ReportedBy BleepingComputer, SecurityWeek, The Record, Hacker News, The Hacker News, not officially confirmed yet
What to doCheck exposureCheck your wallet and Polymarket account for unexpected transfers or sold positions from October 29.
How sure is this?5 independent sourcesSeveral independent publishers agree

How the attack works simplified

  1. 1Attacker compromises vendorThird-party script provider is breached
  2. 2Malicious script swapped inPage-speed script replaced with draining code
  3. 3Signed-in user loads siteActive trader session is exposed to the script
  4. 4Funds moved outPositions sold and crypto sent to attacker wallet
  5. ResultAttacker drains trader funds

What happened

A third-party page-speed script loaded by Polymarket was replaced with malicious JavaScript that hijacked signed-in trader sessions, sold positions, and moved funds to attacker-controlled wallets on October 29.

Why it is dangerous: Signed-in Polymarket traders lost funds, about $2.5 to $2.7 million across 726 wallets according to reports. Anyone who used the site with an active session during the incident was at risk.

Are you affected?

You are affected if you were signed in to Polymarket on October 29 while the compromised third-party script was loaded on the site.

Polymarket website users signed in on October 29; third-party page-speed script (reported as DebugBear) served to the site.

What to do

  1. Check your wallet and Polymarket account for unexpected transfers or sold positions dated October 29.
  2. Watch for refund notices from Polymarket, which says affected wallets are being made whole.
  3. Change passwords and sign out of active sessions on Polymarket if you used it on October 29.

Timeline

  1. 29 Oct 2026, 21:47 UTC
    Publicly disclosed
  2. 29 Oct 2026, 21:47 UTC
    Reported by BleepingComputer · BleepingComputer
  3. 29 Oct 2026, 21:49 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 09:44 UTC
    SecurityWeek reported on it · SecurityWeek
  5. 30 Oct 2026, 09:44 UTC
    Severity raised to critical
  6. 30 Oct 2026, 11:41 UTC
    The Record reported on it · The Record
  7. 30 Oct 2026, 16:42 UTC
    Hacker News reported on it · Hacker News
  8. 1 Nov 2026, 07:55 UTC
    The Hacker News reported on it · The Hacker News

Sources 5 reports, oldest first

Security press established security newsrooms

Community discussion sites, treat with care

Technical details

ID
ZR-fe7730fa · ZR-5fd19759 · ZR-2a3e4a8e
Disclosed
29 Oct 2026, 21:47 UTC
On Zero Radar
29 Oct 2026, 21:49 UTC (2 min after disclosure)
Last change
1 Nov 2026, 07:55 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Polymarket site hijacked via third-party script, draining trader funds · Zero Radar