Polymarket’s $2.7M Drain and a Tampered Claude Code Add-On

Polymarket halted trading on its international platform on 29 October after, in its own words, “One of our 3rd party providers was compromised”. An account withdrew at least $2.7 million across 710 other wallets that day, according to an analysis by Betting Intelligence and Polysights provided to CNBC.

A person familiar with the matter told CNBC the issue stemmed from a hack of DebugBear, a website performance monitoring platform. DebugBear posted that it was hit by a security incident at 18:00 UTC; Polymarket posted that it had fixed the issue 32 minutes later, by our arithmetic.

Short explainer · Polymarket’s $2.7M Drain: 32 Minutes From Vendor Warning…

A vertical news Short narrated from this piece’s headline and opening line.

Business Pill · LEAST PRIVILEGE

A short Business Engineer explainer on least privilege: giving software only the access its task needs. It teaches the general idea only and says nothing about Polymarket, Railway, Cursor or any company in this piece.

What Polymarket and DebugBear Said

DebugBear wrote on X: “We’re impacted by an ongoing security incident.” It told customers: “If you use our RUM product, please remove the embed code from your website.”

Polymarket’s post at 18:33 UTC said it had “temporarily halted trading” and that “Anyone who has been impacted will be made whole.” At 19:00 UTC it posted: “Trading is now fully back online.”

Polymarket did not name the provider. NBC News also cited a person familiar with the details who said the hackers gained access to the funds via software from DebugBear. NBC said Polymarket did not confirm that users had lost money.

CNBC reported that the company’s U.S. platform was not compromised. It said Polymarket told users on Discord that those with less than $10,000 taken would have funds restored by 30 October, while larger claims require a release form.

What Was Posted on X

DebugBear says it is impacted by an ongoing security incident and asks users of its RUM product to remove the embed code from their websites.

Dan Robinson argues that third-party analytics and monitoring scripts are site-takeover risks, says in his view this is what took down Polymarket, suggests products that let teams pin the tracking script, and says Detail uninstalled its session replay; these are his claims and views.

Polymarket says it identified and fixed an issue on its international platform, that one of its third-party providers was compromised and that it has referred this to law enforcement, that anyone impacted will be made whole, and that it temporarily halted trading.

Railway’s Breach and the AI Keys

Nine days earlier, the cloud platform Railway was breached. Its preliminary report says: “Early investigations tell us this attack was attempting to obtain AI provider API keys to perform distillation attacks.”

Railway puts the attack window at 20 October 13:58 UTC to 22 October 03:32 UTC. It says “at most 1.85% of all workspaces had some environment variables potentially compromised”, or “about 100,000 workspaces”.

Railway says it worked with “GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Stripe, and others to revoke the potentially compromised keys”. It also says it “is unable to refund customers for spend performed with compromised API keys”.

A Tampered Claude Code Add-On, the Same Day

Cursor said a maliciously modified Claude Code extension sat in its marketplace on 29 October, affecting “At most 5,000 users”, as we reported in our Cursor piece. Cursor’s notice says the package “was not developed by Anthropic”.

Felix Rieseberg of Anthropic wrote on X that it “wasn’t a compromise of Anthropic’s systems or employee laptops”. He said a malicious actor used access to Cursor’s marketplace “to publish a tampered copy of the Claude Code extension, which we didn’t build or publish”.

Ars Technica later reported that it is still unknown how attackers got access to Anthropic’s verified Cursor account, and quoted Phorion’s Luke Roberts calling it “a supply-chain compromise where the attacker gained access to the official distribution channel”. Our Cursor piece has the update.

The same evening, about $6.36 billion moved out of Binance wallets from 20:05 UTC, according to TRM Labs, as we covered in our Binance piece. No source we read links that incident to a vendor; we list it only for its timing.

A Former Analytics CTO’s Response

Dan Robinson, whose X profile lists Detail and previously Heap and who wrote that he was an analytics CTO in a past life, said he “would strongly consider uninstalling any third party js right now”. He argued: “If you use a tracking script from a third party SaaS, then if they get hacked the hackers have total control over your site too.”

He wrote that Detail “just uninstalled our session replay”, and suggested using “a product that lets you pin the tracking script and control when it changes”. Those are his views; the vendors he names did not comment in the posts we read.

The Structural Read

As we read the posts, the vendor warned its own customers first: DebugBear asked users of its RUM product to remove the embed code from their websites, and Polymarket posted 32 minutes later that it had fixed the issue and halted trading.

As we read Railway’s report, the target in its breach was AI access itself: Railway says the attack was attempting to obtain AI provider API keys, and that it cannot refund spend run up with compromised keys.

As we read Anthropic’s and Cursor’s statements, the Claude Code incident sat in a distribution channel, not in the model maker: Rieseberg says the tampered copy was published through Cursor’s marketplace and was not built by Anthropic.

Three Implications

FOR PLATFORMS THAT EMBED VENDOR SCRIPTS DebugBear told customers using its RUM product to remove the embed code from their websites, and Polymarket says it will make affected users whole.

FOR AI API SPEND Railway says the attacker was seeking AI provider API keys and that it is unable to refund customers for spend performed with compromised keys.

FOR EXTENSION MARKETPLACES Cursor says at most 5,000 users were affected by a tampered Claude Code extension in its marketplace, which Anthropic says it did not build or publish.

The Business Engineer Lens

This story maps onto the Business Engineer framework Inside Anthropic’s Permission Layer.

The analysis describes the governance layer this way: “It is where decisions are made about who gets access to frontier intelligence, under what conditions, and for which purposes.”

As we read it, API keys and extension marketplaces are part of that layer in practice: Railway says its attacker wanted AI provider keys, and Cursor’s marketplace carried a tampered Claude Code copy. The analysis was published in June 2026 about Anthropic; it does not discuss Polymarket, Railway or Cursor.

What Is Not Established

Polymarket has not named the provider; the DebugBear link comes from people familiar with the matter cited by CNBC and NBC News. The $2.7 million is an outside analysis of public data, not a Polymarket figure, and The Block, citing Arkham, put the sum at about $2.65 million, according to NBC.

Railway says its investigation is ongoing and that it is “not yet able to share the specific details and scale of the exploits”. No source we read connects the Railway, Polymarket and Cursor incidents to the same attacker.

The Bottom Line

Polymarket halted trading on 29 October after a third-party provider was compromised; people familiar told CNBC and NBC it was DebugBear, and an outside analysis counts at least $2.7 million withdrawn. DebugBear’s warning came 32 minutes before Polymarket’s fix post, by our arithmetic. Railway says its own breach was aimed at AI provider API keys.