A swapped-out speed-tracking script on Polymarket's site moved some traders' funds to hackers. Polymarket is paying back $3.9 million in total.
Hackers got into Polymarket traders' accounts on October 29 without breaking into Polymarket itself. They replaced a small tool the site loaded from an outside company. That code sold some signed-in traders' positions and sent the money to the hackers. Polymarket says it is refunding about $2.7 million to 726 affected wallets.
Many websites load small pieces of code from other companies. Polymarket loaded a page-speed script from DebugBear, a company that measures how fast pages load for real visitors. Hackers took over DebugBear's web address through its domain registrar, the company that manages the address. That let them serve their own file in place of the real script, and the swapped file was Polymarket's copy.
Blockchain records show crypto worth about $2.64 million reached the hackers' wallet in under an hour. The first funds arrived at 17:10 UTC and the last at 18:02 UTC.
The code borrowed the access a signed-in trader already had in an open Polymarket page. It then followed one of two paths, depending on how the trader signed in.
In both cases the code asked the account's own signer to approve its requests. Researchers say that alone does not prove a trader approved anything without seeing a prompt. A wallet provider may still ask the trader, refuse, or apply its own rules.
The main group is Polymarket traders who were signed in, especially with email or crypto wallet logins. Website owners are the second group. DebugBear has told customers of its monitoring product to remove its embed code from their sites.
There is some reassurance. Hudson Rock reviewed the malicious file without running it. It found no part that sends a password, a seed phrase or a private key to the hackers' server. Traders also do not need to file a claim to get money back.
Polymarket says it removed the script within the hour, cleared every cache, reset all active login sessions and paused trading until the site was clean. It has referred the case to law enforcement. By October 30, 689 of the 726 wallets had been refunded in full. The other 37 were being paid as they were checked.
Polymarket is also paying $1.19 million to about 5,500 wallets that lost money during the trading pause or had positions taken. In all, it is returning $3.9 million. It says it is bringing outside scripts back with extra safeguards.
The steps in the alert box above cover what traders and site owners should do now. The habit worth keeping is simple: if a wallet asks you to sign something you did not start, say no.
DebugBear says its early findings point to an attack on one customer's website. It has seen no sign of a break-in to its own systems, though it is still looking. How the hackers got into the registrar account has not been explained.
Read every wallet signing request before you approve it, and reject any you did not expect, even on a site you trust.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
