Polymarket suspended trading following a security breach that stole $2.5 million in cryptocurrency from users. The attack exploited a vulnerability in DebugBear, a third-party service provider, which distributed malicious JavaScript code through its infrastructure. This code hijacked authenticated user sessions on Polymarket to execute unauthorized transactions.
The platform has since patched the vulnerability and resumed normal operations. Polymarket has committed to fully reimbursing affected users, though the exact number of compromised accounts has not been disclosed. The incident underscores the risks posed by supply chain vulnerabilities in fintech platforms, where a single compromised third-party tool can expose thousands of users to substantial financial loss.