Polymarket Drained Again: A Hijacked Monitoring Script and $2.6M in POL
On October 29, 2026, Polymarket suffered a frontend security breach where attackers drained approximately $2.64 million worth of POL tokens from users through a compromised DebugBear monitoring script.
The attack began at 17:10:23 UTC on Thursday, October 29, 2026, when address 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18 received its first POL tokens. By 17:45:57 UTC, Polymarket trader @CarOnPolymarket posted: "If you are a Polymarket user, lock down your account. I just got drained $800,000." Ten minutes later, they added: "All my positions were sold."
Polymarket quickly responded with a build timestamp of 17:59:20 UTC and commit message chore(polymarket): remove debugbear rum script (#15337). DebugBear followed at 18:00:58 UTC with: "We're impacted by an ongoing security incident. If you use our RUM product, please remove the embed code from your website." By 18:19:58 UTC, the attacker held 28,636,284 POL, worth about $2.64 million at DefiLlama's price of $0.0922.
Third-Party Script Vulnerability
DebugBear's RUM (real user monitoring) script is a standard web tool that measures page performance by running inside visitor browsers with full page privileges. On Polymarket, this script sat next to trading functionality, giving it unintended access to user accounts. The malicious script, served at cdn.debugbear.com/C7xcKKrjUnXK.js, specifically targeted Polymarket's infrastructure.
We're impacted by an ongoing security incident. If you use our RUM product, please remove the embed code from your website.
Attack Mechanism
The drainer script read authentication data and API keys from local storage, then located Polymarket's order-book client in the page's component tree. It fetched configuration from data.debugbear.com/metrics/init, with defaults sending everything to the attacker's address and skipping portfolios worth less than $10. The script had two attack paths depending on how users signed in.
For email users, it sold positions through fill-and-kill orders. For external wallet users, it transferred tokens via ERC-1155 calls. The script prioritized pUSD balances, converting them to POL through api.fun.xyz. Polymarket's gasless relayer unwittingly funded the attack transactions.
Platform Response
Polymarket deployed a fix 48 minutes and 57 seconds after the first theft, removing the DebugBear script and updating content security policies. The platform also entered cancel-only mode with relayer actions paused, preventing new trades but freezing all users. This marked Polymarket's third security incident since May, following a $600,000 operational wallet breach and a $3 million frontend attack in June.
The attacker's address had no prior activity before 17:10 UTC, with funds arriving through multiple transactions. Most transfers occurred between 17:25-18:02 UTC. While the CDN showed the drainer was last modified on October 27, it's unclear when it began serving malicious code to users.
Related
