Polymarket temporarily halted trading after a third-party tool (DebugBear) was compromised, resulting in about $2.65M in unauthorized withdrawals; Polymarket promised to reimburse affected users.
[1][2]← Week of Oct 25Oct 25 – Oct 31 UTC Every claim links to the posts behind it01 02 03 04 05 06 07 08 09 6 posts on X 1 week
Microtrend / Rank 10 / Week of Oct 25 – Oct 31
Polymarket halts trading after DebugBear third-party compromise drains ~$2.65M, promises full reimbursement
Peak / day8tracked accounts
Peak dayFriOct 30 · busiest day in the panel
Rest of X / peak day—not measured outside the panel
Cited claims9source links retained
Market—no token attached
Attention
Who was talking, day by day
Tracked paneldistinct tracked accounts / day
What happened
Polymarket temporarily halted trading after a third-party tool (DebugBear) was compromised, resulting in about $2.65 million in unauthorized withdrawals; Polymarket said affected users will be reimbursed. The attack reportedly involved a compromised DebugBear performance-monitoring script delivering malicious JavaScript that executed in users' browsers and exploited active sessions to sell positions and withdraw funds. @diditrading separately accused @CarOnPolymarket of falsely claiming an $800K loss from the incident while on-chain funds went to his own alt wallet.
Why it matters
Polymarket is a major prediction market, and this incident shows how a trusted third-party dependency can become a vector for wallet drains without private keys or seed phrases being compromised. The platform's promise to reimburse affected users and the debate around who qualifies (e.g., those whose positions were sold) will test user trust and set a precedent for how DeFi platforms handle third-party breaches. The @CarOnPolymarket accusation adds a reputational and fraud-allegation layer to the story.
Observed reaction
Mostly concerned, with some optimism around reimbursement promises. @moneyacademyke and @ikarusz26 focus on the promised full reimbursement for Polymarket affected users, though @ikarusz26 notes complications around sold positions. @icplegend1966 amplifies the alert with a warning tone. @diditrading expresses anger and accuses @CarOnPolymarket of faking an $800K loss. @krishna__web3 frames the separate Predict.fun $400K incident as a security wake-up call but praises the reimbursement promise. @murkiwaters is alarmist about overall crypto safety, calling October the worst month and citing Binance's hack. @aaakasei and @darklord_gr provide critical/analytical threads.
Spread
Where it started and who carried it
- First seen
- Oct 25, 19:02 UTC by @aaakasei
- Accounts
- 7 tracked · 11 elsewhere on X
- Communities
- nft culture (2), prediction mkts (2), eth defi (1), general ct (1)
- Key accounts
- @diditrading, @moneyacademyke, @bloomtrading, @theinsiderpaper, @bitcoinnewscom
Explainability
Evidence register
The Polymarket attack reportedly involved compromised DebugBear website performance monitoring script delivering malicious JavaScript, executing inside users' browsers and exploiting active sessions to sell positions and withdraw funds.
[1]@diditrading alleged that @CarOnPolymarket claimed an $800K loss but on-chain funds went to his own alt wallet, calling the behavior narcissistic.
[1]@ikarusz26 said it will be interesting to see how Polymarket reimburses affected users, noting drained funds and sold positions complicate the situation.
[1]BloomTrading Bot users reported nearly $1M in unauthorized wallet drains; an official statement confirmed 49 wallet addresses belonging to 9 users were affected and that all affected users will be fully reimbursed.
[1][2]CoinDCX experienced a $16M hack, with $15.99M USDT moved from linked wallets to a new address; @aaakasei wrote a thread explaining the incident.
[1]Binance says a compromised DevOps engineer's laptop allowed unauthorized withdrawals totaling about $6.3B, with roughly $3B frozen on-chain so far; withdrawals remain paused and the company will cover all losses.
[1]Referencing the Binance hack, @murkiwaters said October is now the worst month in crypto, called the Binance hack the largest ever, and noted funds aren't safe anywhere.
[1]@aaakasei criticized Indian CEXs for poor incident communication, citing WazirX ($230M hacked in July 2024, withdrawals frozen 463 days) and BitBNS ($7.5M hacked in 2022, initially denied).
[1]Angles
Formats in use
- quote-tweet with commentary
- official statement screenshot
- thread
- text-only alert
- on-chain data screenshot
Risks
- Unverified allegations of fraud against @CarOnPolymarket could be defamatory if not clearly framed as an accusation by @diditrading.
- Polymarket's official reimbursement process and timeline are not detailed in the posts; avoid presenting reimbursement as guaranteed or immediate beyond the platform's stated promise.
- DebugBear's role as a possible attack vector is flagged as suspected, not fully confirmed by all sources; mark as unverified.
- Do not conflate the multiple security incidents (Polymarket, BloomTrading, CoinDCX, Binance, WazirX, BitBNS) as one event; each is separate and should be attributed correctly.
- No financial advice or price predictions should be inferred from reimbursement promises or halted trading.
Observed content
Most-engaged posts
October is now the worst month in crypto. Binance hack yesterday is the largest ever in crypto. $6bn+ lost. Funds are not safe anywhere. Putting them in financially strong and reputable platforms mitigates some of the risk (not all). At least they have resources to make wholeOpen on X →
Predict. fun Hit by Suspected Third Party Compromise 400K USDT lost and the prediction market industry has another security wake-up call $PREDICT reported unauthorised wallet transfers linked to a suspected compromise of its third-party API documentation site The good part isOpen on X →
Update on the @Polymarket security incident: Polymarket confirms that a third-party provider was compromised. The issue has been fixed, but trading remains temporarily halted. Affected users will be reimbursed. DebugBear has also disclosed a security incident involving its RUMOpen on X →
India is a CEX deprived country they rarely tell users what actually happened it's always deny delay deflect disclose damage control -> WazirX was hacked $230M in July 2024 and withdrawals were frozen for 463 days users reportedly never received their full money till day ->Open on X →
🚨 $ICP ♾️🔥 ANOTHER CRYPTO WALLET SECURITY ALERT — NEARLY $1 MILLION REPORTEDLY DRAINED! 🔐 ⚠️ @BloomTrading USERS REPORT MAJOR LOSSES ON SOLANA! Reports are emerging of a suspected security incident involving BloomTrading Bot, with users reporting unauthorised transfers fromOpen on X →
It’ll be interesting to see how Polymarket reimburses affected users. It’s not just about the drained funds, but also the positions that were sold and the fact that interacting with the site is no longer safe, which makes the situation much worse.Open on X →
History