Hijacked Third-Party Script on Polymarket Leads to $2.7M Theft from Trader Wallets

What happened

According to The Hacker News, malicious code was injected into Polymarket's website through a compromised third-party page-speed script sourced from an external vendor, DebugBear. On October 29, the tampered script reportedly sold the positions of some signed-in traders and redirected their funds to attacker-controlled wallets. Polymarket says it is refunding approximately $2.7 million to 726 affected wallets, and blockchain records show roughly $2.64 million in crypto reaching the attackers.

Why it matters for defenders

This is a supply-chain compromise via a third-party script, not a flaw in Polymarket's own application code. It's a reminder that any externally hosted JavaScript loaded on a page — analytics, performance monitoring, A/B testing, ad tech — runs with the same trust and privilege as first-party code in the browser. For sites handling authenticated sessions and financial transactions, a single compromised vendor script can translate directly into unauthorized trades and fund transfers. Any organization loading DebugBear or similar third-party tags on authenticated or transactional pages should treat this as a wake-up call, not just Polymarket users.

What defenders should watch for or do now

• Inventory all third-party scripts loaded on authenticated/transactional pages and assess whether they're necessary there at all.
• Use Subresource Integrity (SRI) hashes and strict Content-Security-Policy (CSP) directives to constrain what external scripts can execute and where they can send data.
• Monitor for unexpected changes to script content served from third-party domains (hash/version drift monitoring on vendor-hosted JS).
• Watch for anomalous transaction or trading activity immediately following script or vendor updates — e.g., unexplained position closures, withdrawals, or approvals clustered in a short window.
• Review browser-side telemetry and outbound network calls from pages that embed third-party tags for unexpected destinations.
• Re-evaluate vendor risk for any analytics/performance tooling with write access to pages handling funds or sensitive sessions.

Developing situation

Details on the exact compromise mechanism at DebugBear and the full scope of affected users are still emerging, and attribution has not been established. This note will be updated if further confirmed details surface. For the original reporting, see The Hacker News.