Hijacked DebugBear Script Steals About $2.7 Million From Polymarket Traders
Summary
A hijacked DebugBear page-speed script injected malicious code into Polymarket, redirecting signed-in traders’ positions and funds. Blockchain tracing identified about $2.64 million moved; Polymarket says it is refunding affected users and adding script protections.
Key points
- Polymarket said malicious code replaced an external DebugBear page-speed script on October 29 and affected signed-in traders.
- Hudson Rock's analysis found the code reused the account's in-page signer and Polymarket relayer; API keys alone could not place orders.
- Ohey traced 28.6 million POL, worth about $2.64 million at the cited price, and positions from 33 wallets to the attacker's wallet.
- DebugBear said its DNS records were compromised through its domain registrar; its early findings showed no sign its own systems were breached.
- Polymarket removed the script, cleared caches, reset active sessions, paused trading, and referred the case to law enforcement.
- By October 30, 689 of 726 affected wallets had been refunded; Polymarket said it would return $3.9 million in total, including additional trader compensation.
- Polymarket said it is restoring third-party scripts with added checks, including a stronger Content Security Policy, pinned versions, and sandboxing.
Article Details
- Victim Organization
- Polymarket
- Incident Type
- Compromised third-party script delivered malicious code that used signed-in traders' sessions to move or sell positions and transfer funds.
- Incident Date
- 2026-10-29
- Disclosure Date
- 2026-10-29
- Data Types Exposed
- Browser-stored account details and trading API keys were read by the malicious code; Hudson Rock found no evidence that the code sent the keys, a password, a seed phrase, or a private key to its reporting server.
- Affected Records
- Polymarket reported 726 affected wallets. Ohey's blockchain trace found the attack wallet received tokens and positions from 33 wallets.
- Operational Impact
- Polymarket switched its exchange to cancel-only mode, paused relayer actions and trading, removed the script, cleared caches, and reset active login sessions. It said it was returning $3.9 million to traders, including about $2.7 million for 726 affected wallets.
- Ransom Or Extortion
- No ransom or extortion was reported.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | cdn[.]debugbear[.]com | Address that served the malicious file after DebugBear's DNS records were compromised; The Hacker News reported it had no DNS record when checked on November 1. |