Polymarket Wallet Drain Evidence, DebugBear Exploit, and Fund Recovery The Polymarket wallet drain began on October 29, 2026. Within about an hour, funds left hundreds of trader accounts with
The Polymarket wallet drain began on October 29, 2026. Within about an hour, funds left hundreds of trader accounts without the owners' approval, and Polymarket blamed a compromised third-party provider.
Polymarket is a prediction market, a site where traders buy and sell shares tied to real-world events. Its international platform runs on Polygon, so every transfer leaves a public record.
Those records make this case easy to study. Early estimates put the loss between $2.5 million and $2.73 million.
The Polymarket platform lets traders take positions on events like elections, sports, and economic data. Each share pays out based on whether the event happens.
Balances sit in accounts linked to Polygon, a public blockchain that logs every transfer. The officialPolygon blockchain explorer shows wallet addresses and transfers, though not the names behind them.
A wallet is software that stores the keys needed to approve transfers. A crypto wallet drain is an attack that empties it by getting transfers approved without the owner's real consent.
This case worked differently from the usual route of stolen seed phrases or fake websites. Researchers found no code in the script for stealing passwords, seed phrases, or private keys. It reused the access that logged-in traders already had open.
That detail sets the Polymarket wallet drain apart from standard phishing. No copycat site was needed, because the real site delivered the harmful code.
The Polymarket site loaded a monitoring script from DebugBear, a UK firm that tracks page speed and visitor experience. Such scripts run on every page with the same trust as the site's own code.
DebugBear said attackers compromised its DNS records through a domain registrar. DNS works like an internet phone book, matching web addresses to servers.
After that change, the script address stayed the same, but a different server answered it. The swapped file looked for active Polymarket sessions instead of measuring page speed.
Researchers rebuilt the sequence from public Polygon data and site build records. All times are UTC on the day of the attack.
Time (UTC)
Recorded event
17:10
First unapproved withdrawals appear.
17:25
The main wave of drains begins.
17:59
Build data shows the monitoring script removed.
~18:05
Cancel-only mode starts, and the relayer is paused.
18:10
Last drain of the main wave
~19:00
Trading resumes
Cancel-only mode lets traders cancel open orders but blocks new trades. A relayer is the service that sends signed transfers to the blockchain for a trader, as Polymarket's official documentation explains.
The script came out at 17:59, yet drains ran until 18:10. Pausing the relayer, not deleting the file, appears to have stopped the flow.
Public on-chain transaction records counted 985 withdrawals across 737 accounts, about $2.73 million in total. Other trackers reported 710 wallets and $2.5 million to $2.7 million, so totals depend on who counts and when.
One attacker wallet, hard-coded in the script as a fallback recipient, gathered about 28.6 million POL, worth roughly $2.64 million. POL is the native token of Polygon. The funds were later split across three new wallets.
In the Polymarket wallet drain, the attacker also opened a fresh account to cash out prediction shares taken from 33 accounts. Splitting funds across new wallets is a familiar step in crypto theft tracing.
In a sample of 30 drains, each approval was used three to seven seconds after it was created. That speed points to automation, not manual clicking.
Polymarket halted international trading, removed the script, cleared caches, and reset login sessions. The separate US platform was not affected, and the case went to UK authorities.
By October 30, about 689 of 726 affected wallets, roughly 95%, had full refunds. Polymarket said it will return $3.9 million in total. That covers $2.7 million tied to the attack and about $1.2 million for losses during the pause.
After the Polymarket wallet drain, the company also planned tighter controls on outside scripts. These include stricter Content Security Policy rules, pinned versions, and sandboxing. Such steps matter well beyond one platform, ascrypto exchange security cases show.
A Content Security Policy is a browser rule list that limits where a page may load code from. The harmful file came from an approved vendor address, so those rules saw nothing odd.
Subresource Integrity is a browser feature that rejects files whose content no longer matches a stored fingerprint. It could have caught the swap, but few sites use it on monitoring tools.
On-chain monitoring also struggled. Every transfer carried a valid signature from a real session, so the Polymarket wallet drain looked approved at the blockchain level.
No. In June 2026, a hijacked vendor script drained about $3 million from fewer than 15 accounts, and refunds were promised then too.
The analyst view is that repeated incidents point to weak vendor oversight more than bad luck. Polymarket has not said what changed after June. Traders can lower risk through basiccrypto wallet security habits, such as reviewing sessions and revoking unused approvals.
Entry method: DebugBear said a registrar compromised its DNS records, but how attackers gained that access is not public.
Exposure window:The time the swapped file first went live is unknown, so affected-visitor counts are estimates built from wallet activity.
Final loss total:Trackers show 710 to 737 accounts and $2.5 million to $2.73 million in losses.
Code behavior:Researchers studied the script without running it, so the findings show intent, not proof that every transfer succeeded.
The Polymarket wallet drain shows how trust in one vendor script can become trading power over user accounts. No smart contract was breached, and the records show a fast, automated process lasting about an hour.
Refunds cover most affected wallets, but the entry method, exposure window, and final loss total remain open. Official technical findings are the next item to track, since wider crypto security incidents often follow the same vendor-trust pattern.
Disclaimer:
This article is for information only and is not financial or investment advice. Crypto assets and prediction markets carry high risk, and reported figures can change quickly. Independent research is needed before any decision.
