Polymarket halts trading after supply-chain attack drains user funds without passwords
WeldPond · x · 2026-10-30
Polymarket paused trading for about an hour after attackers drained user funds by hijacking active sessions to sell positions and withdraw money through the platform itself — no passwords or seed phrases required.
The attack originated from a compromised DebugBear website-monitoring script that users' browsers trusted, a classic supply-chain attack.
Trading has resumed. Polymarket says affected users will be reimbursed and the incident has been referred to UK law enforcement.
Related event: Polymarket Supply-Chain Attack Drains Over $2.5 Million From Users(4 posts)→
More from Safety
- "Alignment for security is a fallacy": SAINTCON slide goes viral — Bedrovelsen · 2026-10-30
- CVPR's new prior-work rule for arXiv preprints sparks fairness debate among researchers — CSProfKGD · 2026-10-30
- He put all global law into Git with Claude Code — and hit #1 on HN — SnooPeripherals5313 · 2026-10-30
- NY data center moratorium was summer's most-lobbied bill as spending hit $64.5M — news-10 · 2026-10-30
- First major AI company breach will be a privacy nightmare, researcher warns — ohlennart · 2026-10-30
- DOJ uncovers international scheme using AI-generated 'ghost students' to steal hundreds of millions in federal aid — Polymarket · 2026-10-30