# Polymarket Hackers Steal $2.7 Million via Compromised DebugBear Script

> Attackers hijacked a third-party DebugBear page-speed script on Polymarket to drain $2.7 million from 726 user wallets via unauthorized transactions.

- Published: 2026-11-01T19:59:12.000Z
- Severity: medium
- Category: Threat Intel
- Tags: Supply Chain Attack, Cryptocurrency, Credential Theft, Polymarket, DebugBear
- Author: Runtime Rebel Intel
- Primary source: https://thehackernews.com/2026/11/hackers-steal-about-27-million-from.html
- Canonical: https://runtimerebel.com/blog/polymarket-hackers-steal-2-7-million-via-compromised-debugbear-script

## Key points

- Immediate impact: Attackers stole approximately $2.7 million from 726 user wallets on the Polymarket prediction market using a malicious script.
- Affected systems: Polymarket traders utilizing specific browser sessions and prediction market web interfaces loaded with third-party tracking scripts.
- Remediation: Organizations must implement strict Content Security Policies, script pinning, and sandboxing for all third-party external resources.

## Overview of the Polymarket Supply Chain Incident

On October 29, malicious actors compromised a third-party script loaded on the prediction market platform Polymarket, resulting in the theft of approximately $2.7 million from 726 user wallets. According to [The Hacker News](https://thehackernews.com/2026/11/hackers-steal-about-27-million-from.html), the attack leveraged a hijacked real user monitoring (RUM) script originally provided by an external vendor, DebugBear. The injected code abused active browser sessions to liquidate positions and siphon funds to the attacker's wallet within a single hour.

Blockchain records analyzed by researchers at Ohey and Hudson Rock indicated that the malicious activity occurred rapidly. The destination wallet received funds between 17:10 UTC and 18:02 UTC, accumulating approximately 28.6 million POL tokens alongside hijacked trading positions before distributing the assets to multiple secondary addresses.

## Technical Analysis of the Script Injection

Security researchers investigating the incident discovered that the domain registrar for DebugBear experienced a DNS compromise. This compromise allowed unauthorized parties to substitute the legitimate monitoring script with malicious code served from the address previously utilized by Polymarket.

Rather than harvesting raw private keys or seed phrases directly, the injected script operated within the context of an already authenticated browser session. It leveraged existing trading [API](/glossary#api) keys and browser storage details to automate malicious actions:

* **Wallet-Based Accounts:** The script directly transferred trader positions straight to the [threat actor](/glossary#threat-actor)'s wallet by interacting with the page's transaction signer.
* **Email-Based Accounts:** The script programmatically sold user positions at severely unfavorable prices before moving the resulting funds off-platform.

Analysts noted that the script programmatically requested approvals from the account's designated transaction signer, handing the signed requests directly to Polymarket's relayer. While wallet providers may still prompt users for [authorization](/glossary#authorization), the sheer speed of the automated routine caught many active traders off guard.

## Incident Response and Remediation

Polymarket responded quickly to the unauthorized activity, entering a cancel-only exchange mode and pausing relayer actions by 18:05 UTC. Company representatives stated that the malicious script was removed within an hour of detection. Subsequent containment measures included clearing browser caches, resetting all active login sessions, and temporarily halting trading operations.

To address financial damages, Polymarket initiated full refunds for the 726 affected wallets by October 30. Furthermore, the platform allocated additional funds to compensate users who suffered losses during the mandatory trading pause.

### [Hardening](/glossary#hardening) Third-Party Script Integrations

Security teams managing web applications that rely on external dependencies should prioritize defensive architectural changes to prevent similar supply chain compromises:

* **[Content Security Policy (CSP)](/glossary#content-security-policy-csp):** Enforce strict CSP headers to restrict where scripts can be loaded from and limit the execution of unauthorized inline scripts.
* **Subresource Integrity (SRI):** Utilize cryptographic hashes for all third-party scripts to guarantee that loaded files have not been tampered with in transit.
* **Script Sandboxing:** Isolate third-party widgets and monitoring tools within restricted iframes or sandboxed environments to limit their access to DOM elements and sensitive session tokens.

**Related:** [Emerging Cyber Threats and Espionage Risks in Neurotechnology](/blog/emerging-cyber-threats-and-espionage-risks-in-neurotechnology), [ClickFix Attacks Deliver macOS Stealer Targeting Crypto](/blog/clickfix-attacks-deliver-macos-stealer-targeting-crypto)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/polymarket-hackers-steal-2-7-million-via-compromised-debugbear-script