Polymarket Fixes Supply-Chain Attack After $2.71 Million in Losses

Polymarket restored service Friday after fixing a security breach on its international platform; the incident caused about $2.71 million in user losses, and the company pledged full reimbursement.

GoPlus, a security firm, attributed the breach to a supply-chain compromise involving a real-user monitoring (RUM) script from DebugBear, a performance monitoring provider. The firm said malicious code reached Polymarket user pages and misused permissions for trading and transaction signing.

The main on-chain path involved 710 DepositWallets and 731 addresses, with estimated losses of about $2.71 million. The address total does not represent the number of affected users; it counts addresses in the transaction path.

Polymarket said it fixed the issue and restored service on its international platform. It pledged full reimbursement for affected traders, with repayment progress to be detailed in later official updates. Polymarket is a prediction-market platform, and the attack involved a third-party monitoring script delivered to user pages.