--- title: "Malicious DebugBear Script Injected Into Polymarket Drains Trader Assets" description: "Cybersecurity researchers discovered wallet-draining JavaScript loaded via a third-party analytics integration, with one user reporting an $800,000 loss." url: https://basisdesk.news/news/polymarket-breach-third-party-debugbear-script published: 2026-10-29T19:11:26.546Z modified: 2026-10-29T19:11:26.546Z section: Security & Hacks author: Basis Desk Newsroom (AI-generated, source-verified) sentiment: bearish tickers: [POL] tags: [polymarket, exploit, debugbear, polygon, wallet-drainer] license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice. --- # Malicious DebugBear Script Injected Into Polymarket Drains Trader Assets Cybersecurity researchers discovered wallet-draining JavaScript loaded via a third-party analytics integration, with one user reporting an $800,000 loss. ## At a glance - **What happened:** Polymarket removed a compromised DebugBear monitoring script after researchers found code designed to hijack user sessions and drain funds. - **Why it matters:** The supply-chain exploit abused native frontend permissions to sign transactions and liquidate positions, bypassing standard API restrictions. - **Who is affected:** Polymarket users who maintained active web sessions while the infected script was served on Oct. 29, 2026. - **What's next:** Investigation into the initial compromise mechanism and an official accounting of aggregate platform losses. - **Primary source:** [Polymarket Breach Alert: Wallet-Draining Code Found in a Third-Party Script](https://www.infostealers.com/article/polymarket-breach-alert-wallet-draining-code-found-in-a-third-party-script) — infostealers.com ## Key points - Malicious JavaScript hosted via a DebugBear CDN script targeted Polymarket user sessions on Oct. 29, 2026. - The code hijacks active React trading signers and EIP-712 relayer messages to sell positions or transfer tokens. - Polymarket removed the script at 17:59:20 UTC, while one trader reported losing $800,000 from liquidated positions. ## Editorial remark - **Context:** Frontend supply chain compromises remain a persistent attack vector across decentralized finance and prediction platforms, weaponizing legitimate performance and analytics dependencies. - **Impact:** Users interacting with Polymarket while the malicious script was active faced unauthorized asset liquidations and token drains, with the designated recipient address holding roughly $2.19 million. - **Watch:** An official incident post-mortem from Polymarket detailing the full scope of drained funds, initial access vector, and any user compensation plans. Polymarket experienced a client-side security breach on Oct. 29, 2026, after malicious JavaScript disguised as a performance-monitoring script was served to users, according to cybersecurity researchers at Hudson Rock [1]. The 15,187-byte payload, hosted via a compromised DebugBear content delivery network URL, targeted active trading sessions to liquidate positions and transfer funds [1]. Production build metadata from Polymarket indicates the platform removed the integration around 17:59:20 UTC with the commit note "chore(polymarket): remove debugbear rum script (#15337)" [1]. A subsequent scan confirmed that Polymarket had permitted the host in its Content Security Policy [1]. ## Session Hijacking and Asset Drainage According to Hudson Rock's analysis, the payload operates without requiring direct exfiltration of private keys or passwords [1]. Instead, it searches active browser local storage for Polymarket authentication tokens, proxy wallet addresses, and central limit order book (CLOB) API keys [1]. It then traverses internal React component state to hijack the platform's live trading client and wallet signer [1]. Depending on the detected account type, the script executes divergent theft mechanisms [1]: * For externally owned accounts (EOAs), it compiles and executes batch ERC-1155 token transfers directly to an attacker-controlled fallback address [1]. * For accounts using Magic login authentication, it submits aggressive market-sell orders across active positions and sweeps the resulting balances [1]. * It constructs EIP-712 deposit-wallet batch messages on Polygon, attempting to push the signed transactions through Polymarket's relayer [1]. The script configured an attacker address—0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18—which held approximately $2.19 million across POL and other tokens on PolygonScan at the time of discovery, though aggregate incident-related losses remain unverified [1]. One trader, operating under the account @CarOnPolymarket, reported a loss of $800,000 alongside the unauthorized liquidation of all open bets [1]. The exploit emerges amid heightened scrutiny surrounding prediction markets, which operate complex order routing systems for speculative wagers, as detailed in [Crypto Prediction Markets, Explained: Yes/No Shares and Oracles](https://basisdesk.news/news/prediction-markets-how-they-work). The exact mechanism behind the third-party DebugBear script injection remains under investigation [1]. ## Sources 1. [Polymarket Breach Alert: Wallet-Draining Code Found in a Third-Party Script](https://www.infostealers.com/article/polymarket-breach-alert-wallet-draining-code-found-in-a-third-party-script) — infostealers.com, 2026-10-29 --- Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai