Hackers Steal $2.7 Million from Polymarket Traders via Compromised DebugBear Script

On October 29, 2026, Polymarket users conducting trades on the prediction market website observed unauthorized transactions that liquidated their positions and transferred funds to external wallets. Investigation revealed that the attack vector was a compromised DebugBear page-speed optimization script that Polymarket's website loaded from an outside company. The malicious code replaced the legitimate performance-monitoring functionality, executing in the browsers of signed-in traders and enabling the theft of their open positions.

Polymarket confirmed the incident on November 1, 2026, stating that approximately $2.7 million had been stolen from 726 affected wallets. The platform announced it would refund the impacted users. Blockchain analytics firm data showed that roughly $2.64 million in cryptocurrency was transferred to addresses controlled by the threat actors.

The DebugBear script, originally intended to monitor and improve page-load performance, was altered in a supply-chain compromise. The exact method by which the DebugBear script was compromised—whether through a breach of the DebugBear service itself or a third-party dependency—has not been formally confirmed. Polymarket and DebugBear are working to remove the malicious code and assess the full scope of the supply-chain vulnerability.

The incident underscores the growing risk of attacks targeting external scripts and third-party services integrated into websites. For users, the event serves as a reminder to monitor wallet activity and for platforms to enforce strict supply-chain security controls for all external scripts.