Overview
- The attack replaced DebugBear’s real‑user monitoring script on Polymarket’s international site and used code running in users’ browsers to locate order components, request wallet signatures, sell positions, and move funds to the attacker’s wallet.
- Polymarket detected unauthorized activity and moved into cancel‑only mode before removing the malicious script, clearing caches, resetting sessions, pausing relayer actions, and referring the case to UK law enforcement.
- Blockchain traces show the attacker’s collecting wallet began receiving funds in a tight window on Thursday, October 29, and gathered roughly 2.64 million POL tokens in under an hour before forwarding them onward.
- Polymarket pledged $3.9 million in total reimbursements to traders to cover the about $2.7 million stolen plus roughly $1.2 million in pause‑related losses and reported that about 95% of affected wallets had been refunded by October 30.
- The incident highlights a persistent supply‑chain risk for web front ends because third‑party scripts run with page privileges, and vendors should tighten DNS, CSP, pinned versions, sandboxing, and runtime checks to keep authenticated trading pages safe.