Polymarket Hack Drained Trader Wallets Through a Hijacked DebugBear Monitoring Script
Trill News Briefing
The Story
A wallet drainer planted in a hijacked DebugBear monitoring script stole crypto plus prediction market positions from Polymarket traders on October 29, 2026.
The malicious file, served from DebugBear's own CDN, ran in signed in sessions for about an hour before Polymarket stripped the script out at 17:59 UTC and paused trading.
Security researchers at Ohey found the code carried no keys of its own; it borrowed Polymarket's trading client from the page and pushed signed transfers through Polymarket's relayer.
Every host it called except DebugBear's was already allowed by Polymarket's Content Security Policy, so the browser defense meant to stop injected code never objected.
The attacker's wallet took in 28.6 million POL tokens and positions from 33 accounts in 52 minutes, then forwarded everything by 18:38 UTC.
Traces of the payments put losses near $2.6 million to $2.7 million, and Polymarket says it will reimburse every affected trader.
Any site that embeds a vendor's script trusts that vendor with whatever its users can do.
The malicious file, served from DebugBear's own CDN, ran in signed in sessions for about an hour before Polymarket stripped the script out at 17:59 UTC and paused trading.
Security researchers at Ohey found the code carried no keys of its own; it borrowed Polymarket's trading client from the page and pushed signed transfers through Polymarket's relayer.
Every host it called except DebugBear's was already allowed by Polymarket's Content Security Policy, so the browser defense meant to stop injected code never objected.
The attacker's wallet took in 28.6 million POL tokens and positions from 33 accounts in 52 minutes, then forwarded everything by 18:38 UTC.
Traces of the payments put losses near $2.6 million to $2.7 million, and Polymarket says it will reimburse every affected trader.
Any site that embeds a vendor's script trusts that vendor with whatever its users can do.
Why It Matters
It was not even the largest crypto theft of the day. Binance is investigating suspicious outflows that analysts estimate at $3.3 billion to $5.8 billion, and Tether froze more than 1.567 billion USDT, The Block reported; Binance has not confirmed a breach. Polymarket referred its case to police in the United Kingdom, The Associated Press reported. The exposure reaches every site that loads analytics code from a vendor, because a Content Security Policy checks where requests go, not who wrote the script. Watch for Binance to confirm a loss figure and for DebugBear to explain how its CDN was taken.
Go Deeper
Read the original reporting at Ohey.
Read Full Story at Ohey →