Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script

Key Points:

• On October 29, malicious code replaced a page-speed script from DebugBear on Polymarket's website, enabling hackers to sell signed-in traders' positions and transfer funds to themselves, resulting in about $2.64 million stolen within an hour.
• Polymarket is refunding approximately $2.7 million to 726 affected wallets and an additional $1.19 million to 5,500 wallets impacted during the trading pause, totaling $3.9 million in reimbursements without requiring traders to file claims.
• The attack exploited Polymarket's trading API keys and transaction signing processes by injecting code that used the traders' own wallet signers to authorize unauthorized trades, with no evidence that sensitive credentials were sent to the hackers.
• DebugBear's DNS records were compromised, allowing the malicious script to be served from their domain, though DebugBear reports no breach of their internal systems and has advised customers to remove their embed code.
• Polymarket responded by removing the malicious script, clearing caches, resetting sessions, pausing trading, and enhancing security measures such as stronger Content Security Policies, script pinning, and sandboxing; experts recommend avoiding unnecessary third-party scripts on trading pages and scrutinizing unexpected signing requests.