{"id":"polymarket-hijacked-script-theft-oct-2026","category":"supply-chain","status":"live","title":"Polymarket traders lose about US$2.7 million through hijacked DebugBear script","tldr":"A hijacked website script stole about US$2.7 million from Polymarket traders. Trading has resumed and refunds are automatic, but reimbursement is not confirmed complete. Check your positions, balances and refund amount.","summary":"On 29 October, attackers replaced a third-party monitoring script loaded by Polymarket's international website. It used some signed-in traders' active sessions to sell positions and move funds out of their wallets. The Hacker News identifies the script as DebugBear's website performance monitor. DebugBear says its DNS records were compromised through its domain registrar; its investigation remains open. Polymarket removed the script, cleared caches, reset active login sessions and resumed trading. It puts stolen funds at about US$2.7 million across 726 wallets. On 30 October, it said 689 wallets had been fully refunded and the remaining 37 were being verified. It also announced US$1.19 million for around 5,500 wallets affected by lost positions or the trading pause. Refunds are automatic, but completion for every affected wallet has not been confirmed. This was an actual theft, with no device update required from traders.","action":"Check your Polymarket positions, balances and refund amount. Payments are automatic; if yours is missing or incorrect, use the review form linked from Polymarket's official incident page. Reject unexpected wallet signing requests.","product":"Polymarket international website (polymarket.com), through its DebugBear monitoring script","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["polymarket","debugbear","crypto","supply-chain","javascript","wallet-theft"],"affected":["Polymarket.com: some users with active website sessions during the attack on 29 October 2026","DebugBear performance-monitoring script loaded by Polymarket.com"],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Security incident - 3rd party vendor compromised","url":"https://status.polymarket.com/cmvvek1i90eme14ruga1z6tuj","by":"Polymarket","date":"2026-10-30"},{"kind":"post","title":"Refund update: 689 of 726 affected wallets refunded","url":"https://x.com/PolymarketTrade/status/2116177566553764137","by":"Polymarket Traders","date":"2026-10-30"},{"kind":"post","title":"Security incident: remove the RUM embed code","url":"https://x.com/DebugBear/status/2115866496643535293","by":"DebugBear","date":"2026-10-29"},{"kind":"post","title":"Investigation update: DNS records compromised through domain registrar","url":"https://x.com/DebugBear/status/2116306975403250070","by":"DebugBear","date":"2026-10-30"},{"kind":"news","title":"Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script","url":"https://thehackernews.com/2026/11/hackers-steal-about-27-million-from.html","by":"The Hacker News","date":"2026-11-01"}],"started":"2026-10-29","closed":null,"created":"2026-11-01T11:22:49.309Z","updated":"2026-11-01T11:22:49.309Z","cve_notes":[],"timeline":[{"at":"2026-10-30T20:07Z","added":"2026-11-01T11:22:49.309Z","kind":"vendor-revised","text":"Polymarket's postmortem confirmed that a replaced monitoring script abused active sessions. It said it removed the script, cleared caches, reset login sessions and reopened trading; refunds were automatic, with a review form available for disputed or missing payments.","url":"https://status.polymarket.com/cmvvek1i90eme14ruga1z6tuj","by":"Polymarket","patch":null},{"at":"2026-10-30","added":"2026-11-01T11:22:49.309Z","kind":"vendor-revised","text":"DebugBear said attackers changed its DNS records through its domain registrar. Its initial investigation indicated one customer's website was targeted; it had found no indication of an internal systems compromise, but investigation continued.","url":"https://x.com/DebugBear/status/2116306975403250070","by":"DebugBear","patch":null},{"at":"2026-10-30","added":"2026-11-01T11:22:49.309Z","kind":"other","text":"Polymarket said 689 of 726 affected wallets had been fully refunded, with 37 still being verified. It also announced US$1.19 million for about 5,500 wallets affected by lost positions or the trading pause.","url":"https://x.com/PolymarketTrade/status/2116177566553764137","by":"Polymarket Traders","patch":null},{"at":"2026-10-29T17:38Z","added":"2026-11-01T11:22:49.309Z","kind":"disclosed","text":"Polymarket disclosed unauthorised activity affecting users' wallets and said it was investigating.","url":"https://status.polymarket.com/cmvvek1i90eme14ruga1z6tuj","by":"Polymarket","patch":"na"},{"at":"2026-10-29","added":"2026-11-01T11:22:49.309Z","kind":"other","text":"DebugBear acknowledged a security incident and told customers using its Real User Monitoring product to remove the embedded code from their websites.","url":"https://x.com/DebugBear/status/2115866496643535293","by":"DebugBear","patch":null}],"url":"https://hard.fyi/live/polymarket-hijacked-script-theft-oct-2026/","json":"https://hard.fyi/api/live?id=polymarket-hijacked-script-theft-oct-2026"}