$2 Million+ Drained From Polymarket Traders in New Supply Chain Attack

What it is

On 29 October, malicious JavaScript served from DebugBear, a UK website performance monitoring vendor, drained funds from Polymarket.com traders. Polymarket's US platform was reportedly unaffected. Polymarket has not named the vendor itself, and the attribution comes from researchers. DebugBear confirmed it was "impacted by an ongoing security incident" and brought in specialist incident responders.

How it works

Hudson Rock obtained the script from a DebugBear address that Polymarket used. The code looked for a logged-in user's trading tools and portfolio. Depending on account type, it either sold positions and moved the proceeds, or sent position tokens straight to an attacker-set address.

Hudson Rock found no routine that sends a credential map, password, seed phrase or private key to the script's reporting endpoint. The script reuses authority the authenticated application already has. Because of this, a password or key rotation would not have undone the theft.

Preconditions / Affected

• The victim loaded a Polymarket page on the international platform that included the DebugBear RUM snippet.
• The victim had a logged-in session while the script ran.
• Hudson Rock has not determined how the script was tampered with or how many users were hit. It found no sign that other DebugBear customers were targeted.

What to do

• DebugBear urged users of its RUM product to remove the snippet from their sites.
• Polymarket shipped a production build, timestamped 17:59 UTC, with a change note about removing the DebugBear script.
• Check your own pages for third-party monitoring scripts that run inside authenticated sessions. This incident shows such a script can act with the user's authority without stealing credentials. This point is an inference from the incident, not advice the page gives.
• Polymarket said affected users "will be made whole" and has referred the matter to law enforcement.

Caveats

Loss figures are unverified and differ by source:

• A screenshot reviewed by Hudson Rock showed about $2.19 million at the script's hard-coded fallback address. Hudson Rock said this is not a verified tally.
• GoPlus estimates roughly $2.71 million. Its on-chain analysis put the main attack path through 710 deposit wallets and 731 addresses, and it notes the address count does not equal the number of victims.
• Arkham data showed a suspected attacker wallet holding about $2.65 million, the same address hard-coded as the script's fallback recipient.

Polymarket had not disclosed its own loss figure. In June it disclosed an earlier third-party compromise that injected a malicious script into its frontend, with losses reported at around $3 million.