Hackers stole about $2.7 million from traders on Polymarket, a site where people bet on future events, according to The Hacker News. Bad code on Polymarket's website sold some signed-in traders' bets and moved their money to the hackers on October 29, the outlet reported.

The bad code took the place of a script from DebugBear, a company whose tool measures how fast web pages load, The Hacker News reported. DebugBear said on X that its web address records were taken over through the company it uses to register its domain. It said the attack seems to have hit just one customer's website. It has seen no sign of a break-in to its own systems, though it is still checking.

Researchers at Hudson Rock studied the file without running it, the outlet reported. The code used the access a signed-in trader already had in an open Polymarket page. For traders who sign in with their own crypto wallet, it moved their bets straight to the hackers. For traders who sign in by email, it sold their bets at worse and worse prices and then moved the money out.

A blockchain trace by researchers at Ohey found that the hackers' wallet collected crypto and trading positions in less than an hour, The Hacker News reported. The crypto alone was worth about $2.64 million.

Polymarket said it removed the script within the hour, signed everyone out and paused trading until the site was clean. It has sent the case to law enforcement. By October 30, 689 of the 726 affected wallets had been paid back in full, the company said. In all, it is returning $3.9 million to traders, including people who lost money during the pause. Traders do not need to file a claim.

Only The Hacker News has reported this so far, and NewsHabit hasn't seen independent confirmation.

What we know: Polymarket traders lost about $2.7 million, and the company says it is paying them back.
What we don't: Who carried out the attack, and how the domain account was taken over.