Polymarket halted trading on October 29 after attackers compromised a JavaScript file from website monitoring provider DebugBear and used it to serve crypto-draining code on polymarket.com. Researchers traced roughly $2.5 million in stolen funds, and the prediction market says it will make affected users whole.
A Tampered DebugBear Script Served Crypto-Draining Code
Attackers compromised DebugBear’s real-user-monitoring JavaScript, hosted at cdn.debugbear[.]com/C7xcKKrjUnXK.js, so that it delivered malicious code on Polymarket’s genuine domain. Hudson Rock analyzed the 15,187-byte file.
The script prompted users for Polygon EIP-712 signatures. Signing granted attacker-controlled contracts permission to drain assets from the victim’s wallet. Because the prompt appeared on the real Polymarket site, users had little visible reason to distrust the request.
DebugBear Confirms an Ongoing Security Incident
DebugBear said it is “impacted by an ongoing security incident” and told customers to remove its embed code. Its own website was down behind a Cloudflare error page when the story broke. The statement places the compromise on the monitoring vendor’s side, with Polymarket as one downstream customer whose users were exposed.
How Polymarket Responded to the Drain
Polymarket put the exchange into cancel-only mode at 2:05 p.m. ET on October 29. It said it fixed the issue by 2:37 p.m. and halted trading as a precaution. Trading resumed about an hour later. The company removed the script at 17:59 UTC and referred the matter to law enforcement. It has pledged that anyone affected will be “made whole.”
Attacker wallet activity began around 13:50 to 13:56 ET, shortly before Polymarket acted.
Conflicting Estimates of the Amount Stolen
Figures differ by source. On-chain tracing followed about $2.57 million, or 28.6 million POL, from the attacker wallet. Security Online put the total at about $2.65 million, and Hudson Rock saw about $2.19 million still held. One trader reportedly lost $800,000. Taken together, roughly $2.5 million is traced as stolen, and multiple individual traders lost funds.
A Second Vendor-Side Compromise in Months
Reporting also links the incident to a similar vendor compromise that drained about $3.1 million in late June. Reporting describes that earlier incident as similar, and both follow the same route: attackers reach a third-party script and use it to put malicious content in front of users on a legitimate site.
The Polymarket case shows how a monitoring tool, which many sites embed to measure page performance, can become the delivery mechanism. The malicious code did not need to breach Polymarket’s own servers. It ran in the browsers of users who loaded the page.
What Polymarket Told Users About Token Approvals
Polymarket urged affected users to revoke token approvals, since the EIP-712 signatures gave attacker contracts standing permission over assets. The company has not said how many wallets signed the malicious requests.
Several questions are open: how attackers gained control of DebugBear’s script, how long the file carried the malicious code before October 29, and how many users signed. DebugBear has said only that it is dealing with an ongoing incident. The funds traced so far sit in the range of $2.19 million to $2.65 million depending on the source and the moment of measurement.
Timeline of the Polymarket Drain on October 29
Attacker wallet activity was recorded between roughly 13:50 and 13:56 ET. Polymarket switched the exchange to cancel-only mode at 2:05 p.m. ET and announced a fix at 2:37 p.m. Trading resumed about an hour after the halt, and the script itself came out at 17:59 UTC. Polymarket therefore acted within about nine minutes of the last recorded wallet activity, though the drain was already under way by then.
DebugBear’s statement that it is affected by an ongoing incident, and its instruction to customers to remove the embed code, signals that the script was not specific to Polymarket. The company has not said whether other sites were affected.
