Hackers stole cryptocurrency and trading positions from Polymarket users after malicious code replaced a DebugBear script loaded by the prediction market’s website on October 29. The code targeted some traders who were already signed in and used their active sessions to carry out unauthorized transactions.
Polymarket said it is refunding about $2.7 million to 726 affected wallets. Blockchain records reviewed by researchers showed that approximately $2.64 million in POL tokens reached the attackers’ wallet in less than an hour, excluding the value of positions taken during the incident.
The compromised file belonged to DebugBear’s real user monitoring tool, which measures website loading performance. DebugBear said its DNS records had been compromised through its domain registrar and that its initial findings pointed to an attack against one customer’s website. The company said it had not found evidence of an intrusion into its own systems, although its investigation remained ongoing.
Researchers from Hudson Rock downloaded the malicious file from the address Polymarket used to load the DebugBear script. They also identified a change in Polymarket’s website code that removed the script. Researchers from Ohey found that a different server began responding for DebugBear’s web addresses at 18:13 UTC, while the malicious file was still available. Earlier that day, the legitimate version had been served from Google Cloud Storage.
Each DebugBear customer loads its own copy of the script, and the replaced file was the version used by Polymarket. According to Hudson Rock’s analysis, the code reused the access available to a trader already logged into an open Polymarket page. It read browser-stored account information, including trading API keys.
The API keys could not independently place orders because Polymarket transactions also require a wallet signature. Hudson Rock said it found no evidence that the code sent passwords, seed phrases, private keys or the API keys to the server it contacted. Instead, the script looked for Polymarket’s order-placement functions and the signer used to approve transactions.
For users who connected their own crypto wallets, the code could transfer positions directly to the attackers’ wallet. For email-based accounts, it could sell positions at progressively worse prices before moving the proceeds. In both cases, the code asked the user’s existing signer to approve requests and passed them to Polymarket’s relayer. Hudson Rock noted that creating a signing request does not by itself prove that a transaction was approved, since wallet providers may require confirmation, reject the request or apply session-specific rules.
Ohey’s blockchain analysis showed that the wallet embedded in the malicious code received its first funds at 17:10 UTC and its last at 18:02 UTC. During that period, it collected 28.6 million POL tokens and positions from 33 wallets. At 18:19 UTC, the POL was worth about $2.64 million based on a price of $0.0922 calculated by DefiPrime using DefiLlama data. The wallet later sent the tokens to three other addresses between 18:28 and 18:38 UTC.
Polymarket published its first update about unauthorized activity in user wallets at 17:38 UTC. At 18:05 UTC, it said the exchange had entered cancel-only mode and that relayer actions were paused. The company said it removed the script within an hour, cleared its caches, reset active login sessions and paused trading while it cleaned the site. The incident was also referred to law enforcement.
By October 30, Polymarket said 689 of the 726 affected wallets had received full refunds, with the remaining 37 being processed after review. The company is separately paying $1.19 million to about 5,500 wallets affected by losses during the trading pause or by positions being taken. Altogether, Polymarket said it is returning $3.9 million to traders. Users do not need to submit a claim, although the company provides a form for people who believe their payment was incorrect or missing.
DebugBear advised customers using its monitoring product to remove its embed code from their websites. The address that served the malicious file, cdn.debugbear[.]com, had no DNS record when checked on November 1.
Polymarket said it plans to restore third-party scripts with additional safeguards, including a stronger Content Security Policy, pinned versions and sandboxing. Hudson Rock advised websites to avoid unnecessary third-party code on pages used for trading or authentication, apply Subresource Integrity when possible, and review which scripts on signed-in pages can request wallet signatures. It also advised traders to reject signing requests they do not recognize.
Sources: The Hacker News.