Overview
- The breach occurred Thursday, Oct. 29 when Polymarket’s international site loaded a replaced DebugBear real‑user monitoring script that ran malicious JavaScript in signed‑in users’ browsers.
- Blockchain traces show roughly $2.6–$2.7 million flowed to the attacker’s wallet in under an hour, and Polymarket says about 726 wallets were affected.
- The malicious code abused active sessions to trigger wallet signing or relayer actions that sold positions and moved funds, demonstrating a browser‑level attack rather than a smart‑contract flaw.
- Polymarket removed the script, cleared caches, reset sessions, paused trading and relayer actions, has refunded most affected wallets and plans to return $3.9 million total to traders.
- Investigators and security researchers traced the swap to a DebugBear file that was replaced after DNS/registrar anomalies, and experts say sites should limit third‑party code on signed‑in pages, pin or sandbox embeds, and monitor script behavior at runtime.