Polymarket's third-party script hijack: what everyday users should learn

Leaving a trading site open in a signed-in browser tab used to feel normal. On October 29, 2026, that habit collided with a supply-chain problem: a third-party script loaded by Polymarket was replaced with code that used active sessions to sell positions and move funds.

This is not a story about guessing passwords. According to Polymarket’s own status-page postmortem and follow-up reporting, the malicious script piggybacked on sessions people already had open. That is why the lesson travels beyond prediction markets. Any site that loads outside JavaScript into a logged-in page can, in theory, act with the powers your open session already has.

What happened

Polymarket’s status history and October 30 postmortem say:

• A third-party vendor whose performance-monitoring script loaded on polymarket.com was compromised.
• The attacker replaced that script with one built to target Polymarket users.
• For some people who had the site open during a short window on the afternoon of October 29, the script used their active session to sell positions and move funds out of their wallet.
• Polymarket removed the compromised script, cleared caches, paused trading and the relayer, reset active login sessions, and later reopened once the site was cleaned.
• The company says it referred the case to law enforcement and is investigating the threat actor.

Reporting from The Record, The Hacker News, and SecurityWeek identifies the vendor as DebugBear, a real-user monitoring (page-speed) service. DebugBear said publicly that its DNS records were compromised through its domain registrar, that early findings pointed at one customer’s website being targeted, and that it had not seen signs of a break-in into its own internal systems while the investigation continued.

Polymarket’s public postmortem text does not always name the vendor in the short status blurbs. The vendor confirmation and DebugBear statements come from those secondary reports and DebugBear’s own public updates.

Refunds, in Polymarket’s numbers

From Polymarket’s October 30 postmortem on its status history:

• It is returning $3.9 million total: about $2.7 million tied to drained wallets, plus about $1.2 million for pause-related and related goodwill cases.
• As of that afternoon, Polymarket said 95% of affected wallets from the hack had been refunded in full between drained-wallet refunds and goodwill refunds.
• It says no claims were required for the wallets it identified from on-chain and trading data. People who think the amount is wrong were pointed to a review form.

Secondary reporting (for example The Hacker News) has discussed wallet counts around the drained set. Prefer Polymarket’s own refund totals when you only need the high-level outcome.

Why this matters if you never use Polymarket

The attack path is the useful part for a home computer:

1. You sign into a money-moving site.
2. The page loads a third-party script for analytics, chat, ads, or performance monitoring.
3. If that script host is hijacked, the code runs inside your already trusted page.
4. Anything your open session can do, the script may be able to trigger without stealing your password.

Hudson Rock and other researchers described wallet-draining behavior in the malicious JavaScript, as reported by The Record. The practical home takeaway is not the exact function names. It is that an open session is a live key.

What to do on your own computer

If you use Polymarket:

1. Sign out of polymarket.com in every browser and on every device, then close those tabs.
2. Check your balances and recent transfers on the wallet you use with the site.
3. Watch for Polymarket’s refund notes on the status page if you were active during the incident window. Use Polymarket’s own review path if a refund looks wrong.
4. Prefer hardware-wallet or confirm-every-transaction habits when the platform supports them. An open hot session is the weak link this attack used.

If you use other financial or crypto sites:

1. Do not leave signed-in trading or banking tabs open overnight “just in case.”
2. Fully quit the browser after money moves, not only close one tab.
3. Be cold toward unexpected wallet pop-ups or sudden sells you did not start. Treat them as hostile until proven otherwise.
4. Keep the browser updated. Browser patches do not stop a malicious script that a site itself chooses to load, but they still close other holes.
5. Prefer sites that confirm sensitive actions out of band (hardware prompt, mobile approve) when you have the choice.

This incident is also a reminder that “the website looks normal” is not the same as “every script on the page is still the vendor you think it is.”

Do this / don’t do that

Do

• Close and sign out of money sites when you are done.
• Read Polymarket’s status history for the company’s own incident and refund language.
• Review wallet activity after any site you use discloses a script or session incident.
• Keep recoveries and seed phrases offline. This attack path did not need your seed if the open session could already move funds.

Don’t

• Do not ignore a trading tab that sits signed in for hours.
• Do not paste seed phrases into any website “support” chat after news like this.
• Do not assume a password change alone fixes a hijacked open session. Polymarket reset sessions for a reason.
• Do not install random “Polymarket refund helper” browser extensions. Use the company’s own channels.

Bottom line

On October 29, 2026, Polymarket says a compromised third-party performance-monitoring script on polymarket.com used some users’ open sessions to sell positions and move funds (status postmortem). Reporting ties the script host to DebugBear and a registrar DNS compromise. Polymarket says it cleaned the site, reset sessions, involved law enforcement, and is returning about $3.9 million. On your own computer: do not leave signed-in money tabs idle, verify wallet activity after incident news, and treat third-party scripts on financial pages as part of the trust boundary.

Image: Official Polymarket social card from polymarket.com.