Polymarket Users Lose $2.7 Million in Third-Party Script Hack
Polymarket users lost $2.7M through compromised DebugBear monitoring script; platform refunded $3.9M total.
Polymarket's international exchange suffered a supply-chain attack when attackers compromised DebugBear's third-party performance monitoring script running on the platform. The malicious code hijacked 710 active user sessions to execute unauthorized fund transfers and position liquidations during a brief window on October 29, 2026. Polymarket halted trading, purged the compromised code, and committed to refunding $3.9 million in total losses, with 95% of affected wallets reimbursed by October 30.
AI summary of the linked source. Not reviewed by an editor. How this works
Run DebugBear?
Get an email when a new story names DebugBear, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers compromised a third-party performance monitoring script (DebugBear) integrated into Polymarket's platform, injecting malicious code that hijacked 710 active user sessions and executed unauthorized fund transfers. This is a classic supply-chain attack: the platform itself was not directly breached, but implicit trust in an external vendor's script gave attackers a foothold with significant user-level privileges. The incident highlights the systemic risk of loading third-party JavaScript directly into financial applications, where a single compromised dependency can affect hundreds of users simultaneously. Organizations must treat every third-party script as a potential attack vector and apply the same scrutiny to vendor code as to their own.
What helps against this
How we list vendors- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.