The company said the provider was compromised, that it had fixed the issue and referred the matter to law enforcement.
It put its exchange into cancel-only mode at 2:05 p.m. ET, announced a fix at 2:37 p.m., and marked the incident resolved at 3:05 p.m., about an hour after the initial suspension.
Polymarket said on X that trading is fully back online and that it is reimbursing all affected traders.
BleepingComputer analyzed a malicious JavaScript file and found it was designed to hijack logged-in Polymarket sessions, sell users' prediction-market positions, and move cryptocurrency and other assets to a wallet controlled by the attacker.
Depending on how a user signed in, the script either tried to sell positions automatically or tried to send prediction-market tokens directly to the attacker's wallet.
BleepingComputer's review of blockchain activity found that a wallet moved about 28.6 million POL tokens, worth roughly $2.57 million, to three other wallets.
Hudson Rock reported the wallet held about $2.19 million in cryptocurrency when it investigated.
Polymarket has not said how many users were affected, how much was stolen, or how reimbursement will work.
The script was hosted on infrastructure belonging to DebugBear, a service that helps websites monitor loading speed and user experience. DebugBear said it was affected by an ongoing incident and urged customers using its real user monitoring product to remove the embed code. BleepingComputer found the script also communicated with a DebugBear domain to receive instructions and send back data on targeted accounts, wallet addresses, balances, and transaction results, which raises questions about how much access the attackers had to DebugBear's systems. Hudson Rock found Polymarket build metadata showing a commit that removed the DebugBear script. DebugBear's website was inaccessible at the time of BleepingComputer's report, and it is unclear whether that was related to containment. BleepingComputer has asked both companies for comment.
