Polymarket traders lose about US$2.7 million through hijacked DebugBear script
A hijacked website script stole about US$2.7 million from Polymarket traders. Trading has resumed and refunds are automatic, but reimbursement is not confirmed complete. Check your positions, balances and refund amount.
Check your Polymarket positions, balances and refund amount. Payments are automatic; if yours is missing or incorrect, use the review form linked from Polymarket's official incident page. Reject unexpected wallet signing requests.
What’s happening
On 29 October, attackers replaced a third-party monitoring script loaded by Polymarket's international website. It used some signed-in traders' active sessions to sell positions and move funds out of their wallets. The Hacker News identifies the script as DebugBear's website performance monitor. DebugBear says its DNS records were compromised through its domain registrar; its investigation remains open. Polymarket removed the script, cleared caches, reset active login sessions and resumed trading. It puts stolen funds at about US$2.7 million across 726 wallets. On 30 October, it said 689 wallets had been fully refunded and the remaining 37 were being verified. It also announced US$1.19 million for around 5,500 wallets affected by lost positions or the trading pause. Refunds are automatic, but completion for every affected wallet has not been confirmed. This was an actual theft, with no device update required from traders.
- What
- Poisoned software
- Affects
- Polymarket international website (polymarket.com), through its DebugBear monitoring script
- Affected
- Polymarket.com: some users with active website sessions during the attack on 29 October 2026
DebugBear performance-monitoring script loaded by Polymarket.com - Fixed in
- Nothing to patch
- Since
- 29 Oct 2026
Timeline
- Vendor revised
Polymarket's postmortem confirmed that a replaced monitoring script abused active sessions. It said it removed the script, cleared caches, reset login sessions and reopened trading; refunds were automatic, with a review form available for disputed or missing payments.
- Vendor revised
DebugBear said attackers changed its DNS records through its domain registrar. Its initial investigation indicated one customer's website was targeted; it had found no indication of an internal systems compromise, but investigation continued.
- Update
Polymarket said 689 of 726 affected wallets had been fully refunded, with 37 still being verified. It also announced US$1.19 million for about 5,500 wallets affected by lost positions or the trading pause.
- Made publicNothing to patch
Polymarket disclosed unauthorised activity affecting users' wallets and said it was investigating.
- Update
DebugBear acknowledged a security incident and told customers using its Real User Monitoring product to remove the embedded code from their websites.
Sources
- Security incident - 3rd party vendor compromisedPolymarket · 30 Oct 2026
- Refund update: 689 of 726 affected wallets refundedPolymarket Traders · 30 Oct 2026
- Security incident: remove the RUM embed codeDebugBear · 29 Oct 2026
- Investigation update: DNS records compromised through domain registrarDebugBear · 30 Oct 2026
- Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear ScriptThe Hacker News · 1 Nov 2026