Hijacked DebugBear Script Drains About $2.7 Million From Polymarket Traders
Malicious code delivered through a hijacked DebugBear script stole about $2.7 million from 726 Polymarket wallets on October 29, according to The Hacker News. Polymarket said it was refunding the affected wallets, while blockchain records showed that cryptocurrency worth about $2.64 million reached the attackers’ wallet in less than an hour.
The affected file was a page-speed and real-user-monitoring script loaded from DebugBear’s domain. DebugBear said its DNS records had been compromised through its domain registrar, and the investigation had found no evidence at that point that the company’s own systems had been breached. The replaced file was the copy used by Polymarket rather than a shared script serving all DebugBear customers.
The malicious code operated inside an already signed-in Polymarket page. Researchers found that it could read browser-held account details, locate the site’s order and transaction-signing functions, and submit requests through Polymarket’s relayer. Accounts using their own wallets could have positions transferred directly; email-based accounts could have positions sold at increasingly unfavorable prices before the proceeds were moved.
The researchers did not find code sending passwords, seed phrases, private keys or the trading API keys to the attacker’s server. They also cautioned that finding a signing request does not by itself establish that a trader approved it: a wallet provider might display a prompt, reject the request or apply session-specific rules.
Polymarket reported the unauthorized activity at 17:38 UTC and later paused relayer actions while placing the exchange in cancel-only mode. It removed the script, cleared caches, reset active login sessions and paused trading while the site was cleaned. By October 30, 689 of the 726 affected wallets had reportedly received full refunds, with the remaining payments being checked.
The company said it would return $3.9 million in total, including $1.19 million for about 5,500 wallets that lost money during the trading pause or had positions taken. Traders do not need to file a claim, although Polymarket provides a form for people who believe their payment is incorrect or missing.
DebugBear told customers using its monitoring product to remove its embed code from their websites. Polymarket said it would reintroduce third-party scripts with stronger Content Security Policy controls, pinned versions and sandboxing. Hudson Rock also recommended keeping unnecessary external code away from pages where users trade or sign, using Subresource Integrity where possible, reviewing what code on signed-in pages can request from a signer, and rejecting unexpected signing requests.