Yes. Polymarket's international site polymarket.com was compromised on Oct 29 via a third-party script, reported as a DebugBear RUM script at cdn.debugbear(.)com, which injected malicious code into authenticated sessions.

Yes. Polymarket's international site polymarket.com was compromised on Oct 29 via a third-party script, reported as a DebugBear RUM script at cdn.debugbear(.)com, which injected malicious code into authenticated sessions.

Users opening the site got malicious signature prompts that sold positions and drained wallets. Reports started around 17:45 UTC, with trader Car reporting about $800k lost and circulating onchain tallies around $2.6-2.7M to alleged attacker 0x3F99…fc18. Those loss totals are user claims, not verified onchain totals.

Polymarket went to cancel-only mode and paused relayer actions while investigating, then said it identified and fixed the issue, referred one compromised provider to law enforcement, and halted trading temporarily.

Trading is now fully back online per PolymarketTrade, with a promise to fully reimburse all affected traders. Do not sign unknown prompts, revoke approvals if you interacted during the window, and wait for the official all-clear for claims.