Malicious DebugBear Script Drains Millions From Polymarket Traders

Polymarket halted trading on its international platform on 29 October 2026 after users reported unauthorised withdrawals. The exchange switched to a cancel-only mode and suspended relayer actions, then said the issue involved one of its third-party providers and that the matter had been referred to law enforcement. Trading resumed about an hour later, with Polymarket promising to reimburse all affected traders, though it has not named the vendor or disclosed losses.

Security researchers linked the theft to malicious code served from DebugBear, a UK-based website performance monitoring firm; Polymarket’s US platform apparently remained unaffected.

Hudson Rock obtained a copy of the malicious JavaScript from a DebugBear address used by Polymarket. The script hunted for a logged-in user’s trading tools and portfolio and, depending on account type, attempted to sell positions and move proceeds or to send position tokens directly to an attacker-controlled address.

The claim is that the sample reads credential-related material, but no routine was found to exfiltrate passwords or seed phrases; rather, the script reused the attacker’s authenticated access within the Polymarket interface. A Polymarket production build timestamped 17:59 UTC included a note about removing the DebugBear script.

Loss figures vary: a screenshot seen by Hudson Rock suggested about $2.19 million at a hard-coded fallback address (not a verified total), while GoPlus estimated roughly $2.71 million, with on-chain analysis showing the main path across 710 deposit wallets and 731 addresses. Arkham data pointed to a suspect attacker wallet holding about $2.65 million. Hudson Rock has not determined how the script was tampered with or how many users were hit.