Threat watch / Attack
Polymarket: traders drained through a hijacked DebugBear monitoring script
On October 29 a page-speed script that Polymarket loaded from the vendor DebugBear was replaced with a wallet drainer. It used signed-in traders' open sessions to move funds out. DebugBear says its DNS records were compromised through its domain registrar. Polymarket says it has returned $3.9 million.
- Sector
- Finance
- Way in
- Supplier
- Product or vendor
- DebugBear
- How it happened
- The attacker replaced a monitoring script that Polymarket loads from DebugBear. Polymarket says "the attacker replaced the script with one built to target Polymarket users". DebugBear says its DNS records were compromised through its domain registrar, and that it has seen no sign of a break-in to its own systems. The registrar is not named and how the registrar access was obtained is not public.[1][2][3][4] Checked 8 Nov 2026
- What was stolen
- Funds and positions. The Hacker News reports about $2.7 million taken from Polymarket traders. Ohey counts 28.6 million POL reaching the attacker's wallet, plus stablecoins and positions from 33 accounts, and notes Polymarket has not published a figure. Researchers found no code that sent keys, passwords or seed phrases to a server: the script borrowed the signed-in trader's own session and signer.[2][3] Checked 8 Nov 2026
- Who was impacted
- 726 Polymarket wallets, according to The Hacker News and CircleID. Polymarket says users with the site open during a short window on the afternoon of October 29 had their active sessions used to sell positions and move funds out. Polymarket reports $3.9 million returned, including about $1.2 million for losses during its trading pause, and 95% of affected wallets refunded in full at the time of its postmortem.[1][2][4] Checked 8 Nov 2026
- Threat actor
- Not attributed. No attribution. Polymarket has referred the case to law enforcement. CircleID reports that 12 crypto sites were hit by separate DNS hijacks on October 30 and 31, and says no link to this incident has been established.
Timeline
- At 16:54 UTC the DebugBear script host starts failing, then a different server answers for it. The first funds reach the attacker's wallet at 17:10 UTC. [3]
- Polymarket identifies unauthorized activity affecting user wallets at 17:38 UTC and puts its exchange in cancel-only mode at 18:05 UTC. DebugBear tells customers to remove its embed code. [1][2][3]
- Polymarket publishes its postmortem: script removed, caches cleared, all sessions reset, case referred to law enforcement, $3.9 million returned. [1]
- The Hacker News reports DebugBear's statement that its DNS records were compromised through its domain registrar. [2]