Malicious DebugBear Script Injected Into Polymarket Drains Trader Assets

Polymarket experienced a client-side security breach on Oct. 29, 2026, after malicious JavaScript disguised as a performance-monitoring script was served to users, according to cybersecurity researchers at Hudson Rock ¹. The 15,187-byte payload, hosted via a compromised DebugBear content delivery network URL, targeted active trading sessions to liquidate positions and transfer funds ¹.

Production build metadata from Polymarket indicates the platform removed the integration around 17:59:20 UTC with the commit note "chore(polymarket): remove debugbear rum script (#15337)" ¹. A subsequent scan confirmed that Polymarket had permitted the host in its Content Security Policy ¹.

Session Hijacking and Asset Drainage

According to Hudson Rock's analysis, the payload operates without requiring direct exfiltration of private keys or passwords ¹. Instead, it searches active browser local storage for Polymarket authentication tokens, proxy wallet addresses, and central limit order book (CLOB) API keys ¹. It then traverses internal React component state to hijack the platform's live trading client and wallet signer ¹.

Depending on the detected account type, the script executes divergent theft mechanisms ¹:

• For externally owned accounts (EOAs), it compiles and executes batch ERC-1155 token transfers directly to an attacker-controlled fallback address ¹.
• For accounts using Magic login authentication, it submits aggressive market-sell orders across active positions and sweeps the resulting balances ¹.
• It constructs EIP-712 deposit-wallet batch messages on Polygon, attempting to push the signed transactions through Polymarket's relayer ¹.

The script configured an attacker address—0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18—which held approximately $2.19 million across POL and other tokens on PolygonScan at the time of discovery, though aggregate incident-related losses remain unverified ¹. One trader, operating under the account @CarOnPolymarket, reported a loss of $800,000 alongside the unauthorized liquidation of all open bets ¹.

The exploit emerges amid heightened scrutiny surrounding prediction markets, which operate complex order routing systems for speculative wagers, as detailed in Crypto Prediction Markets, Explained: Yes/No Shares and Oracles. The exact mechanism behind the third-party DebugBear script injection remains under investigation ¹.