Polymarket drained via DebugBear RUM script, trading halted

Prediction market Polymarket halted trading on its international platform (Polymarket.com) on 29 October 2026 after attackers compromised a third-party monitoring script and used it to drain user positions. Polymarket said it identified and fixed the issue, referred the breach to law enforcement, and will fully reimburse affected traders. Its US-regulated platform was not affected. There is no vendor advisory yet; this is based on Polymarket's and DebugBear's statements plus on-chain and researcher analysis.

What the script did

The malicious JavaScript was served from cdn.debugbear[.]com and belonged to DebugBear, a web-performance firm whose Real User Monitoring (RUM) product embeds a script on client sites. Once loaded in a logged-in Polymarket session, the script checked the authentication state and then abused the existing session to liquidate prediction-market positions or transfer the position tokens directly to an attacker wallet, converting holdings into transferable assets where it could. It beaconed to data.debugbear.com for instructions and to exfiltrate account, wallet, balance, and transaction data — so DebugBear's own infrastructure served as distribution point and command-and-control at once. DebugBear confirmed an "ongoing security incident" and told customers to remove the RUM embed code from their sites.

Timeline (ET, 29 October)

• 1:50–1:56 p.m. — attacker-linked wallet runs numerous transactions against Polymarket's token contract.
• 1:59 p.m. — a production build timestamp shows the commit removing the DebugBear RUM script.
• 2:05 p.m. — exchange enters cancel-only mode, pauses relayer actions.
• 2:37 p.m. — Polymarket says the issue is fixed; trading halted out of caution.
• ~1 hour later / 3:05 p.m. — trading resumes; incident marked resolved.

What was taken

Hudson Rock identified the attacker-controlled wallet embedded in the script and reported it held roughly $2.19 million at the time of analysis. BleepingComputer traced about 28.6 million POL (~$2.57M) moved to three wallets; the Wall Street Journal's wallet analysis put the figure at over $2.5 million across 900+ transactions. Polymarket has not published a victim count.

Action checklist

1. If you traded on Polymarket.com on 29 October, check the connected wallet for unauthorized position liquidations or token transfers, and revoke any stale token approvals tied to the platform.
2. DebugBear RUM customers: remove the embed code now, per DebugBear's own instruction, and review your own users' sessions for the window above.
3. Any site embedding third-party JavaScript: this is a supply-chain hit, not a Polymarket bug. Pin third-party scripts behind Subresource Integrity where the vendor supports it, scope them with a strict Content-Security-Policy, and alert on unexpected changes to externally hosted script hashes.

Context

This is a textbook client-side supply-chain attack — the same shape as the Convertr/Plausible Magecart skimmer we covered, where a trusted third-party script became the delivery vehicle. It is also Polymarket's second front-end supply-chain incident of 2026: a June compromise of a different vendor injected a drainer script estimated at ~$3 million in losses. The pattern is consistent — the smart contracts held; the browser did not. The open questions are how the attacker gained write access to a DebugBear-hosted file and how long it was live on Polymarket.com.