Compromised DebugBear Script Drains Polymarket Traders’ Wallets

Polymarket temporarily halted trading on its international platform after a compromised DebugBear Real User Monitoring script delivered wallet-draining JavaScript to logged-in traders on October 29. Researchers found that the payload extracted session context and located Polymarket’s existing trading client and signer, reusing legitimate APIs and relayer infrastructure to sell positions, transfer outcome tokens, and redirect funds. The attack abused authority already available in users’ browsers rather than requiring passwords, seed phrases, or fresh transaction approvals. External estimates placed losses at approximately $2.5 million–$2.7 million, but Polymarket had not confirmed the total or affected-user count; traced wallet balances and outflows do not independently establish aggregate theft.

Polymarket removed the DebugBear integration, restricted trading to order cancellations, and paused relayer activity before restoring trading approximately an hour after the suspension. The company pledged full reimbursement and referred the incident to law enforcement; its separate US platform was reportedly unaffected. DebugBear acknowledged a security incident and instructed customers to immediately remove its monitoring embed code, making removal an urgent containment step for other organizations using the service. Ohey's analysis of archived responses and Polygon data places the malicious script between about 16:54 UTC, when DebugBear's script origin stopped responding, and 17:59 UTC, when Polymarket removed it, and documents position-token transfers from 33 deposit wallets. The attacker's identity, initial compromise mechanism and any impact on other DebugBear customers remained unresolved.