A Hijacked Monitoring Script Drained $2M From Polymarket Traders
Malicious code served through DebugBear's monitoring snippet hijacked logged-in Polymarket sessions on Oct. 29, selling positions and moving funds; estimates run from $2.19 to $2.71 million. Polymarket says users will be made whole.
A website-monitoring script that Polymarket loaded from a third party was swapped for code that emptied logged-in traders’ accounts, SecurityWeek reports. Researchers trace it to DebugBear, a UK performance-monitoring company whose real-user monitoring snippet ran on Polymarket’s site. Polymarket paused trading on Oct. 29, says the problem is fixed and has promised affected users will be made whole.
For defenders
What happened: Hudson Rock got a copy of the malicious JavaScript from a DebugBear address Polymarket used. Running inside the page, it looked for the logged-in user’s trading tools and portfolio, then either sold positions and moved the money, or sent position tokens straight to an attacker address, depending on the account type. Hudson Rock says it reads credential-related material but found no code that sends out passwords, seed phrases or private keys; it simply used the access the logged-in session already had. That’s T1195 (Supply Chain Compromise) leading to T1185 (Browser Session Hijacking) and T1657 (Financial Theft).
Confirmed vs. not: DebugBear confirmed an “ongoing security incident” and has brought in incident responders; it hasn’t said how its script was altered. Polymarket says only that a third-party provider was compromised. GoPlus attributes the attack to the DebugBear script and counts about $2.71 million across 710 deposit wallets; Hudson Rock puts about $2.19 million at the script’s hard-coded fallback address and calls that unverified. Polymarket hasn’t disclosed losses, and nobody has named an attacker. The same day’s Binance theft is not linked to this one.
The bigger lesson: this is the second third-party script incident at Polymarket this year, after a June compromise that cost about $3 million, and it follows the Convertr analytics skimmer by days. Any script you load from another company’s server runs with your users’ full session. DebugBear is telling RUM customers to remove its snippet for now. No other DebugBear customers are known to be targeted, and no domains or hashes have been published.
What it means for you
If you trade on Polymarket’s international site and saw positions sold or tokens moved that you didn’t do, Polymarket says it will repay affected users; contact it only through the official site. The thief didn’t need your password: the bad code acted as you while you were logged in. Expect fake “Polymarket refund” messages, and never share a recovery phrase with anyone. Polymarket’s US platform reportedly wasn’t affected.
Do this now
- Review your Polymarket activity from Oct. 29 for trades or transfers you didn’t make, and report them through Polymarket’s official support.
- Ignore refund or “claim your compensation” links sent by email, DM or social media.
- If your website uses DebugBear real-user monitoring, remove the snippet until DebugBear gives the all-clear.
- Website owners: load third-party scripts from pinned, self-hosted copies or with Subresource Integrity and a strict Content Security Policy where you can.