Researchers Find Wallet-Draining Code in Polymarket-Associated Third-Party Script

Summary

Hudson Rock reports that a retrieved DebugBear-associated script contained code targeting Polymarket trading sessions to sell or transfer assets. Polymarket build metadata records removal of the integration; affected users and losses remain unverified.

Key points

Hudson Rock retrieved the same 15,187-byte script twice and found logic that reads account context, searches for a live trading client and signer, and inspects positions.
The code attempts to transfer position tokens for some account types and to sell positions before transferring proceeds for others; the researchers did not execute it or sign transactions.
The sample contains a fallback recipient address also shown in a supplied balance screenshot. The displayed holdings total about $2.19 million, but are not verified incident proceeds.
Polymarket production build metadata records removal of the DebugBear RUM integration at 17:59:20 UTC on October 29, 2026. A homepage snapshot lacked the script reference, but this does not establish the exposure window or complete containment.
The script contains reporting logic for wallet and device information to data[.]debugbear[.]com; the researchers did not execute the sample or verify that those requests were sent.
The number of affected users, attributable losses, initial compromise mechanism, and attacker remain unresolved. The investigation did not establish transaction flows from victims to the recipient.

Article Details

Attack Vectors: Malicious JavaScript was retrieved from the specific script URL associated with Polymarket’s DebugBear RUM integration.
The payload searched browser storage for Polymarket authentication context and traversed React component state to find the live trading client and signer.
Depending on account type and portfolio conditions, the code attempted to sell positions or transfer tokens and proceeds to a configured recipient using signed Polygon deposit-wallet batches.
The payload constructed reporting requests containing wallet, account, device, portfolio, and transfer-result information; the investigators did not execute those requests.
Defensive Notes: For potentially exposed users, reject unexpected signing or approval requests, close potentially exposed tabs, and review orders, position movements, and wallet transactions through a trusted route.
Review sessions, API credentials, and permissions using platform support guidance; do not assume disconnecting a wallet reverses transfers or revokes on-chain approvals.
Preserve exact response bytes, hashes, HTTP metadata, loader references, and browser request history during incident response.
Remove unnecessary third-party integrations from authenticated trading and signing flows; investigate exact payloads and request paths rather than relying on a trusted hostname.
Where applicable, use Subresource Integrity with a restrictive Content Security Policy and controlled update processes, and review which actions untrusted page code can request through the signer.