Polymarket users lose $2.7 million in suspected DebugBear-linked cyberattack: How it unfolded? What we know

Polymarket said it had identified and fixed the vulnerability, adding that it had referred the matter to law enforcement in the United Kingdom, where DebugBear is based.An official familiar with the investigation identified DebugBear, a UK-based website performance monitoring company, as the third-party provider involved, according to Wall Street Journal.How the Polymarket security breach unfoldedPolymarket initially halted trading on its international exchange, Polymarket.com, after detecting a security issue involving an external service provider.Polymarket subsequently switched to a cancel-only setting, allowing users to withdraw existing orders but preventing them from placing new ones.

Relayer operations, which facilitate transactions on the platform, were also suspended while the company investigated.On trading platforms, cancel-only mode means that traders cannot place new orders to buy or sell a contract, but can still cancel outstanding orders.Polymarket described the suspension as a precautionary measure. It later announced that the issue had been resolved and trading had resumed."We’ll make this right and are fully reimbursing all affected traders," the company said in a post on X.What is the suspected role of DebugBear?DebugBear, which provides website performance monitoring and debugging services, acknowledged that it had been affected by an ongoing security incident.The company advised customers using its Real User Monitoring (RUM) product to remove the embedded code from their websites.

Its website was also reportedly inaccessible on Thursday afternoon.DebugBear posted on X that it had been “impacted by an ongoing security incident” and advised customers who used one of its products to “remove the embed code from your website.”According to researchers at cybersecurity firm Hudson Rock, a script served through DebugBear contained code designed to identify an active trading session belonging to a signed-in user.

The script allegedly attempted to liquidate the user's holdings and transfer the proceeds to another wallet.Researchers also said the code contained a cryptocurrency wallet address embedded as a destination for the stolen funds.The precise circumstances that enabled the compromise, as well as the total number of affected accounts, remained unclear.Suspected attacker wallet holds more than $2.7 millionAn analysis of blockchain transactions by The Wall Street Journal identified a wallet associated with a suspected attacker that appeared to have received more than $2.5 million from Polymarket users.

The funds were moved through more than 900 transactions. Data from blockchain analytics platform Arkham, cited by Decrypt, showed that the wallet held approximately $2.65 million worth of POL, the native token of the Polygon network.Separately, DeFi Llama estimated the losses from Thursday's incident at approximately $2.7 million, putting the suspected theft close to the scale of an earlier breach involving the platform.Polymarket has faced previous security breachesThursday's incident is not the first time Polymarket users have suffered losses following a security compromise involving an external provider.In May, approximately $700,000 was reportedly drained from an internal top-up wallet after its private key was compromised.A separate incident in June involved malicious code being introduced into the platform's frontend through a compromised third-party vendor.

The attack resulted in roughly $3 million being taken from fewer than 15 accounts. Polymarket subsequently pledged to reimburse affected users.The latest breach raises fresh questions about the security risks associated with third-party services integrated into cryptocurrency trading platforms.