Last updated: October 30, 2026
On October 29, 2026, Polymarket paused trading after a script from DebugBear, a third-party website-performance service, was found carrying wallet-draining code that hunted for logged-in users, sold their positions and sent the money to the attacker. One analysis counted at least $2.7 million moved from about 710 wallets. Polymarket says everyone affected will be made whole, and trading resumed the same day. Polymarket's own code wasn't hacked — a vendor's was, and every page that loaded the vendor's script ran the attacker's code. Below: how it worked, why third-party scripts are a crypto risk, and how to protect yourself.
- $2.7M+ moved, per one analysis
- ~710 wallets affected
- 1 compromised vendor script
- 3rd Polymarket security incident of 2026
What happened
Users reported money leaving their Polymarket accounts without permission. Polymarket switched its international platform to cancel-only mode, where traders can cancel orders but not place new ones, paused relayer actions and said that "one of our 3rd party providers was compromised". Researchers at Hudson Rock found the cause: a script loaded from DebugBear, a service sites use to measure page speed, had been replaced with code that looked for a logged-in trading session, tried to sell the user's positions and transfer the assets out. DebugBear confirmed a security incident.
The suspected attacker wallet held about $2.65 million after swapping USDC.e to POL through a cross-chain service. Polymarket removed the script, said the issue was fixed and resumed trading around 3 p.m. ET. Its US platform didn't appear to be affected. It's Polymarket's third incident this year: in May a leaked key drained about $700,000 from an internal wallet, and about a month later another compromised vendor let attackers inject code that took about $3 million from fewer than 15 accounts.
Why one vendor script can drain wallets
A script on a web page runs with the same powers as the site's own code. It sees what you see and can click what you can click. Many sites load scripts straight from vendors' servers: analytics, chat widgets, A/B testing, speed monitoring. If any vendor is hacked, the attacker's code runs on every site that uses it, for every visitor, with no change to the site itself.
| Wallet setup | What a malicious page script can do |
|---|---|
| Logged-in session with a site-managed or email wallet | Act through your session: sell, transfer, withdraw, if the session can do it without asking you |
| Browser extension wallet (MetaMask, Rabby and others) | Pop up a fake or misleading transaction or signature request — you still have to approve it |
| Hardware wallet | Same request, but the real details appear on the device screen — if you read them |
That's why the attack targeted logged-in sessions: on a platform where the session can trade for you, no extra approval is needed. The same mechanics power wallet drainers, and the same weak spot — a trusted supplier — was behind the Binance hack the same day.
How sites can block this
- Don't load third-party scripts on pages that move money. Analytics and monitoring can be self-hosted or kept off trading and wallet pages.
- Content Security Policy (CSP) tells the browser which script sources are allowed, so injected or unknown scripts are refused.
- Subresource Integrity (SRI) pins a script to a hash: if the vendor's file changes, the browser won't run it.
- Re-confirmation for withdrawals: a second factor or a delay means a hijacked session can't empty an account in seconds.
notkyc.life loads no third-party scripts at all. Every script is served from our own domain, and a strict CSP with per-request nonces blocks anything else, including outside analytics. See our no-logs approach.
How to protect yourself
- Log out of trading and betting sites when you're done. A session that doesn't exist can't be hijacked.
- Keep only what you're actively using on platforms that hold your funds or session-managed wallets. Savings go to a wallet you control — not your keys, not your coins.
- Use a content blocker. It stops many third-party scripts from loading, though not all.
- Read every signature request. On a hardware wallet, check the address and amount on the device screen — see blind signing explained.
- Review old approvals after any incident on a site you've used — how to revoke token approvals.
- Use a separate browser profile for crypto, with no random extensions — see fake browser extensions.
Frequently asked questions
Was Polymarket hacked?
Not directly. A third-party script from DebugBear, a website-performance service, was compromised and ran wallet-draining code on Polymarket's site. Polymarket removed it and resumed trading the same day.
How much was stolen from Polymarket users?
One analysis counted at least $2.7 million moved from about 710 wallets; the suspected attacker wallet held about $2.65 million. Polymarket hasn't published an official figure.
Will Polymarket users get their money back?
Polymarket says anyone who was impacted will be made whole and that it is fully reimbursing affected traders.
What is a third-party script attack?
An attacker hacks a vendor whose code many websites load, such as analytics or monitoring, and replaces it with malicious code. Every site using the script then runs the attacker's code for its visitors.
Does notkyc load third-party scripts?
No. All scripts on notkyc.life come from our own domain, outside analytics aren't used, and a strict Content Security Policy blocks scripts from anywhere else.
Swapping doesn't require an account or a session that can be hijacked: compare live offers on /swap, for example BTC → XMR. Coins go straight to your own wallet. No account, no ID, no logs.
Sources: Decrypt, NBC News, The Crypto Times.