Polymarket: DebugBear monitoring script turned into a wallet drainer

What happened

• 29 Oct 2026. Polymarket put its international platform into cancel-only mode after users reported unauthorized withdrawals. Loss estimates: about USD 2.71M (GoPlus), about USD 2.65M in a suspected attacker wallet (Arkham), about USD 2.19M at the script’s fallback address (Hudson Rock). Polymarket has not disclosed a figure.
• Root cause: Polymarket said “one of our 3rd party providers was compromised”. Researchers tied the malicious code to the real user monitoring (RUM) script of DebugBear, a UK web performance vendor. DebugBear confirmed it was “impacted by an ongoing security incident” and told customers to remove its RUM snippet. How DebugBear was compromised is not disclosed.
• Mechanism (Hudson Rock): the injected JavaScript reused the logged-in session to sell positions and move proceeds, or to send position tokens to an attacker address. No credential or key exfiltration routine was found.
• Attribution: none.
• Response: trading resumed about an hour later. Polymarket referred the case to law enforcement and said affected users “will be made whole”. The US platform was reportedly unaffected.

Sources

• https://www.securityweek.com/2-million-drained-from-polymarket-traders-in-new-supply-chain-attack/
• https://hackread.com/polymarket-users-lose-2-7m-third-party-script-hack/
• https://www.scriptmonitoring.com/blog/debugbear-polymarket-script-compromise/
• https://thehackernews.com/2026/11/hackers-steal-about-27-million-from.html

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.