Polymarket Sends $3.9M Back to Traders After Vendor Script Drain

What it is

Polymarket's international site loaded a page-speed monitoring script from DebugBear's CDN on 29 October 2026, and that script was swapped for a wallet drainer. Polymarket has not named the vendor. Its public build log shows a commit pulling the "debugbear rum script", which is the basis for the attribution. Scott Helme of Report URI gave the account of the mechanism.

How it works

The drainer ran inside logged-in sessions for about an hour. It dumped or moved positions and swept cash out through Polymarket's own relayer. The page says Polymarket's contracts were not the problem. The weak point was third-party code running in the same page as wallet signing.

flowchart LR
    A[DebugBear CDN script] -->|swapped for drainer| B[Polymarket page]
    B --> C[Logged-in session]
    C --> D[Polymarket relayer]
    D --> E[Cash swept out]
    F[Hash pinning] -. blocks swapped file .-> B

What to do

Helme says Polymarket's Content Security Policy (CSP) allowlisted every domain the drainer touched, so a domain allowlist did not stop it. He says pinning the script to a known hash would have kept the swapped file from running. The page gives no commands or configuration.

Impact figures

• Thefts total $2.7M from 726 wallets. A further $1.19M goes to about 5.5K wallets that lost out during the trading pause or had positions taken. Together this is the $3.9M being repaid.
• Bitquery's analysis found the median victim lost $171. Four accounts that each lost over $100K made up 43% of the haul.
• By Friday morning, 689 of the 726 wallets were fully repaid. The last 37 are paid as each is verified.

Caveats

• Larger victims reportedly must sign a release to be repaid. Terms users shared include ID checks and a broad non-disparagement clause. Polymarket has not publicly addressed them.
• The page treats the hash-pinning claim as Helme's argument, not a tested result.
• A Polymarket postmortem is promised but not yet published. The earlier vendor compromise since June took roughly $3M from a far smaller group of accounts.