Polymarket Traders Lose $2.7 Million via Compromised DebugBear Script
Malicious code injection via third-party script leads to unauthorized fund transfers and platform-wide security overhaul.
1Supply Chain Attack Mechanism
On October 29, attackers compromised the DNS records of DebugBear, a third-party service provider. By replacing a legitimate page-speed script with malicious code, they targeted Polymarket users. This supply chain vulnerability allowed unauthorized access to browser-stored account details, enabling the attackers to manipulate trading positions without needing direct access to private keys.
2Execution and Financial Impact
The malicious script executed between 17:10 and 18:02 UTC, draining funds from 726 affected wallets. Blockchain analysis confirmed that 28.6 million POL tokens, valued at approximately $2.64 million, were transferred to the hackers' address within an hour. The total financial impact, including trading losses, reached $3.9 million across thousands of user accounts.
3Exploiting Browser-Side Access
The injected code did not steal passwords or seed phrases directly. Instead, it leveraged existing session access to interact with Polymarket’s order-placing and transaction-signing functions. For crypto-wallet users, the script moved positions directly, while email-based accounts suffered from forced sales at unfavorable prices, effectively liquidating assets into the attackers' controlled wallet addresses.
4Immediate Incident Response
Polymarket detected the unauthorized activity and initiated a response at 17:38 UTC. The platform entered a cancel-only mode, paused its relayer actions, and removed the malicious script within one hour. Furthermore, the company cleared all site caches and reset every active login session to prevent further unauthorized access to user accounts.
5Comprehensive Refund Strategy
By October 30, Polymarket had fully refunded 689 of the 726 directly affected wallets, with the remaining 37 processed shortly thereafter. Additionally, the company allocated $1.19 million to compensate approximately 5,500 users who experienced losses during the trading pause or had positions liquidated. No formal claims were required from the affected traders.
6DebugBear Security Status
DebugBear reported that the attack specifically targeted one customer's website through a domain registrar compromise. The company stated that its internal systems showed no signs of a direct break-in. Despite this, DebugBear advised all customers to remove its embed code from their websites until the security environment is fully verified and stabilized.
7Future Security Enhancements
Polymarket is implementing stricter controls for third-party script integration to prevent recurrence. These measures include enforcing a stronger Content Security Policy, utilizing pinned versions for all external dependencies, and sandboxing third-party scripts. These architectural changes aim to isolate external code, ensuring that a single vendor compromise cannot impact the platform's core operations.
8Industry Security Implications
This incident highlights the inherent risks of loading external scripts directly into high-value trading environments. Security researchers emphasize that users should always reject unexpected signing requests. For platforms, the event underscores the necessity of rigorous supply chain auditing and the implementation of robust defense-in-depth strategies to protect against third-party service provider failures.