Hackers Drain $27 Million from Penpie DeFi Protocol in Major Crypto Heist
On October 29, 2026, Polymarket suffered a supply chain attack when hackers compromised a third-party performance monitoring script and used it to drain funds from active traders. The attackers replaced a legitimate page-speed script from DebugBear with malicious code that targeted signed-in users, ultimately stealing approximately 2.64 million dollars worth of cryptocurrency from 33 wallets within less than an hour. Polymarket has committed to refunding about 2.7 million dollars to 726 affected users.
The breach occurred through DebugBear's domain registrar, where attackers compromised DNS records to redirect traffic away from the legitimate script hosted on Google Cloud Storage. By 18:13 UTC on the attack day, researchers observed that requests for DebugBear's script were being answered by a different server serving the malicious version. DebugBear has stated that preliminary evidence suggests only Polymarket was targeted and that their own systems appear uncompromised, though their investigation is ongoing. Each DebugBear customer loads a unique copy of the monitoring script, and it was specifically Polymarket's copy that the attackers replaced.
The malicious code operated by exploiting the permissions that authenticated users had already granted to the Polymarket website. It extracted trading API keys stored in the browser but did not need to steal sensitive credentials like passwords or private keys. Instead, the code cleverly located the site's order placement functions and transaction signing mechanisms, then executed trades on behalf of victims. For users who connected with external crypto wallets, it transferred positions directly to an attacker-controlled address. For email-based accounts, it sold positions at increasingly unfavorable prices before moving the funds out.
The attack window was remarkably brief and efficient. The hardcoded attacker wallet received its first stolen funds at 17:10 UTC and continued collecting assets until 18:02 UTC, accumulating 28.6 million POL tokens and various positions from victims. Between 18:28 and 18:38 UTC, the attackers quickly moved all stolen POL tokens to three separate addresses, likely to obscure the trail. Polymarket issued its first alert about unauthorized wallet activity at 17:38 UTC and took its exchange offline at 18:05 UTC, but by then the majority of the damage had already been done.
Stay secure — stay Wavasec. 🔐
