Attackers reportedly took about $2.7 million from more than 700 Polymarket accounts on October 29. The entry point was a tampered script supplied by DebugBear, a UK website-monitoring vendor, which ran inside users' logged-in sessions on Polymarket's own site.

Once running, the code checked balances and positions, sold holdings and moved funds to a wallet controlled by the attackers. It is the platform's second vendor-linked incident this year: a June compromise reportedly drained around $3 million.

Polymarket has not confirmed the number of victims or the total taken. It has said affected users will be reimbursed, but those who lost more than $10,000 must sign a release before payment, and it is not yet clear whether that release waives future legal claims.

Betting content is for adults aged 21 or over. Rules differ by state; confirm the rules where you are before you bet. If you or someone you know has a gambling problem, call 1-800-GAMBLER. See our Responsible Gambling page.

Source: Gambling Industry News. Summary written by Playfield Review.