Polymarket halts trading after crypto-draining script breach, $2.5M traced

What it is

On 29 October 2026, JavaScript served from DebugBear's Real User Monitoring (RUM) infrastructure (cdn.debugbear[.]com/C7xcKKrjUnXK.js) drained Polymarket users' accounts. Polymarket says a third-party provider was compromised, referred the matter to law enforcement, and says affected users will be made whole. DebugBear has confirmed an ongoing incident on X.

How it works

The script checks whether the visitor is logged into Polymarket. If so, it reuses the existing trading session and Polymarket's own transaction functions. It reads crypto balances and prediction-market positions to value the holdings, then acts according to how the user authenticated:

flowchart TD
    A[Script runs in logged-in session] --> B[Read balances and positions]
    B --> C{How user authenticated}
    C -->|Some users| D[Auto-sell positions]
    C -->|Others| E[Transfer position tokens to attacker wallet]
    B --> F[Convert crypto to transferable assets]
    F --> G[Send to attacker wallet]

The script talks to data.debugbear[.]com for instructions and sends back target accounts, wallet addresses, balances and transaction results. The same vendor domain therefore served the payload and acted as C2, which BleepingComputer says raises questions about how much of DebugBear's systems the attackers controlled.

Preconditions / Affected

• Any site that embeds DebugBear's RUM script was exposed to attacker-controlled code in visitors' browsers. This payload was written for Polymarket.com sessions.
• Impact depended on a visitor being logged in while the script ran.
• Polymarket has not said how many users were affected or how much was stolen.

What to do

• DebugBear's guidance: "If you use our RUM product, please remove the embed code from your website."
• Polymarket removed the integration in a production build timestamped 29 October, 1:59 p.m. ET, with the commit message "chore(polymarket): remove debugbear rum script (#15337)".
• To check exposure, search your pages and tag manager for DebugBear embeds and block cdn.debugbear[.]com and data.debugbear[.]com.
• Hunt for the attacker wallet 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18, identified by Hudson Rock.

Timeline (ET, 29 October):

• 1:50 to 1:56 p.m.: the wallet made many transactions against Polymarket's prediction-market token contract.
• 1:59 p.m.: the build removing the script was timestamped.
• 2:05 p.m.: cancel-only mode began and relayer actions were paused.
• 2:37 p.m.: Polymarket said the issue was fixed.
• 3:05 p.m.: the incident was marked resolved.

Caveats

• Figures differ by source. BleepingComputer saw about 28.6 million POL (roughly $2.57 million) moved to three further wallets. Hudson Rock reported about $2.19 million held in the wallet when it looked.
• The root cause of the DebugBear compromise is unknown. At time of writing its website showed a Cloudflare error, and the page does not say whether that is part of containment.
• Polymarket and DebugBear had not answered BleepingComputer's questions, and the reimbursement process is undescribed.