Polymarket’s security troubles may be far from over

Polymarket reopened its international exchange on October 29, 2026, after a compromised monitoring script forced a cancel-only shutdown; the US platform was unaffected. It halted orders and relayer activity and promised refunds, with losses under $10,000 due by October 30 and larger claims requiring a release form. Hudson Rock discovered a 15,187-byte malicious payload in DebugBear’s Real User Monitoring script that could access account information, identify trading clients, and attempt to sell positions or transfer tokens; the attack exploited website code, not smart contracts. At least $2.7 million was traced in withdrawals across 710 wallets and about $2.19 million at a fallback address, though total losses are unconfirmed. A June 2026 malicious-script attack reportedly drained about $3 million from at least 11 wallets.