Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script
Hackers stole approximately $2.7 million from Polymarket traders on October 29 by hijacking a third-party script on the prediction market platform.
Malicious code inserted into Polymarket's website sold signed-in traders' positions and transferred their funds to the hackers on October 29. The attack involved replacing a page-speed script normally loaded from an external company. Polymarket has confirmed it is refunding approximately $2.7 million to 726 affected wallets, with blockchain records showing crypto worth about $2.64 million reached the hackers' wallet in under an hour.
The Attack Mechanism
The compromised script came from DebugBear, whose Real User Monitoring (RUM) tool measures website loading speeds. Researchers at Hudson Rock downloaded the malicious file from the address Polymarket used for the DebugBear script and discovered a site code change that had removed it. DebugBear confirmed its DNS records were compromised through its domain registrar, though it found no evidence of a breach to its own systems.
The malicious code exploited existing access traders had in open Polymarket pages, reading account details including trading API keys. Rather than stealing credentials, the code searched for the part of Polymarket's site that places orders and the signer that approves transactions. For wallet-signed accounts, it moved positions directly to the hackers' wallet. For email-signed accounts, it sold positions at unfavorable prices before transferring the funds.
A signing request alone does not prove a trader signed without seeing a prompt. The wallet provider may still ask the trader, refuse, or apply its own rules for the session.
The Theft Timeline
According to blockchain analysis by Ohey, the hacker wallet received its first funds at 17:10 UTC and its last at 18:02 UTC, collecting 28.6 million POL tokens and positions from 33 wallets. At 18:19 UTC, these tokens were worth approximately $2.64 million at a price of $0.0922 per POL. By 18:38 UTC, all stolen POL had been transferred to three other addresses.
Polymarket's Response
Polymarket first reported unauthorized wallet activity at 17:38 UTC and placed its exchange in cancel-only mode by 18:05 UTC. The company stated it removed the malicious script within an hour, cleared all caches, reset login sessions, and paused trading until the site was secured. It has referred the incident to law enforcement.
By October 30, 689 of the 726 affected wallets had been fully refunded, with the remaining 37 being processed as they were verified. Polymarket is also paying $1.19 million to approximately 5,500 wallets that experienced losses during the trading pause or had positions taken, totaling $3.9 million in refunds. Affected traders do not need to file claims unless they believe their refund amount is incorrect.
Preventing Future Attacks
DebugBear has advised customers to remove its embed code from their websites. Polymarket is implementing additional security measures for third-party scripts, including stronger Content Security Policy, pinned versions, and sandboxing. Hudson Rock recommends websites avoid unnecessary third-party code on trading pages and implement Subresource Integrity (SRI) checks to detect unauthorized script changes.
For traders, Hudson Rock advises rejecting any unexpected signing requests. Polymarket continues to restore normal operations while investigating the full extent of the breach and implementing enhanced security protocols.
Related
