Polymarket stopped trading for about an hour after hackers used an outside website tool to push crypto-stealing code. About $2.5 million was traced to the attacker.
Polymarket, a prediction market platform where people trade on how events turn out, halted trading for about an hour on Thursday. Hackers had slipped crypto-stealing code onto its website through an outside tool. About $2.5 million in assets has been traced to a wallet believed to belong to the attacker. Polymarket says everyone affected will be reimbursed.
The weak link was not Polymarket's own systems. It was DebugBear, a service that tracks how fast websites load. Sites that use it add a small piece of code, called JavaScript, to their pages. Hackers compromised DebugBear and used that channel to send harmful code to Polymarket visitors. Polymarket put its exchange into cancel-only mode at 2:05 p.m. ET. It marked the issue resolved at 3:05 p.m. ET.
According to BleepingComputer's analysis, the script checked whether a visitor was logged in to Polymarket. If so, it tried to use that person's existing session and Polymarket's own trading tools to move money. For some users it tried to sell their positions automatically. For others it tried to send their prediction-market tokens straight to the attacker's wallet. It also tried to convert crypto holdings into assets that could be moved.
The script also reported account details, wallet addresses and balances back to DebugBear's servers. That raises questions about how much access the attackers had to the company's systems.
The main group is traders who were logged in to Polymarket.com, the company's international platform. Any other website that uses DebugBear's real user monitoring script could also be exposed. DebugBear has told customers to remove that code from their sites. Nothing in the reporting points to risk for people who do not use Polymarket.com.
The alert box above lists the steps. The short version: look over your account for anything you did not do, and contact support if something looks wrong.
Polymarket has not said how many users were affected, how much was actually stolen, or how reimbursement will work. The dollar figures also differ by source. BleepingComputer saw the suspected attacker wallet send about 28.6 million POL, worth roughly $2.57 million, to three other wallets. Hudson Rock, a security research firm, said the wallet held about $2.19 million when it looked.
DebugBear's own website was down at the time of writing, showing a Cloudflare error. It is unclear whether that is part of its cleanup or another effect of the attack. BleepingComputer has asked both companies for comment.
A tool a website borrows from another company can put your crypto at risk, so keep only what you need to trade on any platform.
A user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websitesA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you call
