Polymarket
United States5 sources
Confirmed:Confirmed by the organisation, a regulator or a securities filing. First reported 29 Oct 2026.
Polymarket loses $2.7m through third-party JavaScript compromise
Polymarket suffered a web supply-chain attack after malicious code replaced a DebugBear performance-monitoring script, manipulating signed-in users' positions and transferring funds. Approximately $2.7 million across 726 wallets was targeted.
- Type
- Supply chain
- Sector
- Finance
- Records
- 726 records confirmed
- First reported
- 29 Oct 2026
- Latest source
- 2 Nov 2026
What to do
- Update the affected app or extension to the version the vendor names as clean.
- If you installed a compromised version, change passwords you used on that machine.
- Search your lockfiles and build logs for the affected package versions.
- If a malicious version was installed, rotate every secret that machine or pipeline could read.
- Pin dependencies and review install scripts in CI.
Not sure? Ask an assistant with the sources attached, or have a coding agent check your systems.
Check your systems for Polymarket