Polymarket restricts trading to cancel-only mode amid wallet drain reports

Polymarket is the dominant crypto-native prediction market, settling wagers in USDC on Polygon and marketing itself as a transparent, on-chain alternative to traditional betting books. On Oct. 29, a monitoring library from third-party vendor DebugBear, embedded in the platform's frontend, was compromised and used to inject malicious JavaScript that intercepted trading sessions. This is a supply-chain attack, the same category that has repeatedly hit crypto sites through compromised npm packages and analytics scripts rather than smart-contract bugs.

Attackers drained roughly $2.65 to $2.7 million from more than 700 wallets before Polymarket moved the exchange into cancel-only mode, locking traders out of new buys and sells while leaving them able to close existing positions. Its October 30 update fixed total reimbursement at $3.9 million, covering both the stolen assets and collateral losses tied to the pause itself. Affected traders get made whole directly from Polymarket rather than chasing recovery through insurers or the attacker, while the company absorbs the cost.

The breach shows how a platform built around trustless, on-chain settlement can still be undone by an ordinary web-stack dependency: a performance-monitoring script no different from thousands embedded across the internet. Polymarket's contracts were untouched, but the user-facing layer that actually moves funds proved to be a single point of failure controlled by an outside vendor. That gap between decentralized settlement and centralized frontend infrastructure is the uncomfortable trade-off this incident puts on display. (per financemagnates.com)

Polymarket said it referred the incident to law enforcement, and whether the vendor is formally identified and held liable will shape whether other platforms using similar monitoring tools face the same exposure. The $3.9 million refund figure set in the October 30 update is the number to track for any revision as reconciliation across the roughly 726 affected wallets is finalized and full payouts are confirmed.