Malicious DebugBear Script Drains About $2.7 Million From Polymarket Traders

A compromised third-party performance-monitoring script on Polymarket sold positions and moved funds from some users with active sessions on October 29, 2026. The script had been loaded from DebugBear, whose vendor infrastructure was compromised. Polymarket said it removed the script, paused trading and its relayer, reset active sessions, and reopened the site after cleanup. The company said it was returning about $2.7 million to wallets affected by the attack, while blockchain analyses placed the amount transferred to attacker-controlled wallets at roughly $2.6 million. Polymarket also said it was returning another $1.2 million for losses related to the trading pause, bringing total refunds to about $3.9 million.

Why it matters

The incident demonstrates how a compromised externally hosted browser script can abuse authenticated sessions and trigger trades or asset transfers without a direct breach of the platform’s core infrastructure. It also highlights the need for financial and crypto applications to use controls such as script integrity checks, version pinning, sandboxing, restrictive content-security policies, and continuous monitoring for third-party dependencies.

Key points

  • The attack occurred on October 29, 2026, during a short window when the malicious script was active.
  • About $2.7 million was associated with funds taken from affected Polymarket wallets, while blockchain investigators traced roughly $2.6 million to attacker-controlled wallets.
  • Polymarket said it was refunding affected wallets and later reported that 95% had been refunded; it estimated total refunds at about $3.9 million after including $1.2 million for trading-pause losses.
  • The malicious code replaced a third-party performance-monitoring script loaded from DebugBear.
  • Polymarket removed the script, paused trading and its relayer, reset active sessions, and said it was adding stronger controls for third-party scripts.

Based on reporting by The original announcement and The Hacker News.