Polymarket halted trading on Thursday after attackers compromised a third-party service to distribute cryptocurrency-draining JavaScript. The malicious script, hosted on DebugBear infrastructure, hijacked authenticated Polymarket sessions to liquidate prediction-market positions and transfer assets to an attacker wallet. Roughly $2.5 million in assets was traced to a suspected attacker wallet, and trading resumed about an hour later. Polymarket says it will fully reimburse affected traders, while DebugBear told customers to remove its embed code and is investigating.
Table of contents
Malicious JavaScript used to drain walletsOnce attackers have valid credentials, only 37% of their actions are blockedQuestions this post answers
How did the Polymarket crypto drainer attack actually work?
Attackers compromised DebugBear, a third-party website performance monitoring service, and modified its Real User Monitoring JavaScript to hijack authenticated Polymarket trading sessions. The malicious script checked users' crypto balances and prediction-market positions, then either auto-sold positions or transferred tokens directly to an attacker wallet, using data.debugbear.com as a command-and-control server. Teams relying on third-party scripts can follow supply chain breach writeups like this on daily.dev.
How much cryptocurrency was stolen in the Polymarket DebugBear breach?
Roughly $2.5 million in assets was traced to a suspected attacker-controlled wallet. Blockchain analysis showed the wallet transferred approximately 28.6 million POL tokens, worth about $2.57 million, to three additional wallets, and separately held around $2.19 million at the time of investigation. Developers tracking the scale and fallout of crypto security incidents can follow updates on daily.dev.
What should websites do if they use DebugBear's RUM monitoring script after this breach?
DebugBear told customers to remove its monitoring embed code from their websites immediately, confirming it was investigating an ongoing security incident. At the time, DebugBear's own website was inaccessible and showing a Cloudflare error, and it was unclear whether that outage was tied to containment efforts. Anyone auditing third-party script dependencies can track incident response details like this on daily.dev.
Share this post