- Published on
Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script
- Authors
- Name
- DeepHorus
Hackers stole about $2.7 million from Polymarket traders on October 29 by hijacking a third-party page-speed script. The code sold some signed-in tradersâ positions and moved funds to a hackersâ wallet. Polymarket is refunding 726 affected wallets and paused trading to clean its site.
The replaced script came from DebugBear, whose real-user monitoring tool measures page load speeds. DebugBear said its DNS records were compromised through its domain registrar. Early findings indicate the attack targeted one customerâs website, with no sign of a breach in its own systems.
Blockchain records show about $2.64 million in crypto reached the hackersâ wallet in under an hour. The wallet collected 28.6 million POL tokens and positions from 33 wallets, then sent the POL to three addresses between 18:28 and 18:38 UTC. Hudson Rock found the code reused signed-in tradersâ browser sessions, including trading API keys, and searched for Polymarketâs order and signing components.
For wallet-based accounts, the script moved positions to the hackersâ wallet. For email-based accounts, it sold positions at worsening prices and transferred the proceeds. Polymarket reported unauthorized wallet activity at 17:38 UTC, then entered cancel-only mode and paused relayer actions at 18:05 UTC.
Polymarket said it removed the script within the hour, cleared caches, reset sessions and referred the case to law enforcement. By October 30, it had fully refunded 689 of 726 wallets and was paying the remaining 37 as checks continued. It is also paying $1.19 million to about 5,500 wallets harmed during the pause or by taken positions.
In total, Polymarket is returning $3.9 million to traders without claims. The incident shows how a compromised third-party script can expose crypto trading sessions without stealing private keys. DebugBear said it was still investigating, and Polymarket offered a form for users who believe their refund is wrong.
