DebugBear RUM script supply-chain compromise drains $2M+ from Polymarket traders
Severity: high · Patch status: no-fix-needed · Since 2026-10-30
Polymarket halted trading on its international platform on October 29, 2026 after users reported unauthorized withdrawals, later confirming a compromised third-party provider. Researchers at Hudson Rock and GoPlus attributed the theft to malicious JavaScript injected into DebugBear's UK-based website performance monitoring RUM script served to Polymarket. The code hijacked authenticated sessions to sell positions and siphon proceeds, or transfer position tokens to a hardcoded attacker wallet, without exfiltrating credentials or keys. Loss estimates range from ~$2.19M (Hudson Rock, unverified) to ~$2.71M (GoPlus), with a suspected attacker wallet holding ~$2.65M. Polymarket removed the script, resumed trading within about an hour, and pledged to reimburse all affected users; DebugBear engaged incident responders and urged customers to remove its snippet. The US platform was unaffected. This is Polymarket's second third-party frontend compromise in 2026.
What to do
- Remove or isolate the DebugBear RUM snippet from production sites until the vendor confirms remediation
- Audit third-party scripts with subresource integrity, CSP, and allowlisting to limit what embedded code can do
- Review Polymarket or similar trading accounts for unauthorized position sales or token transfers and revoke active sessions
- Monitor on-chain flows to the hardcoded attacker address for recovery/tracing efforts
- Reassess vendor risk for analytics/monitoring providers with script-level access to authenticated apps
Sources
All live incidents on Threat Watch
