DebugBear snippet let attackers trade through Polymarket sessions
Hudson Rock and GoPlus linked malicious DebugBear real user monitoring (RUM) code to Polymarket trader withdrawals; figures ranged from a $2.19 million suspected recipient balance to GoPlus’s $2.71 million loss estimate. Polymarket halted international trading October 29, fixed the issue and resumed about an hour later, promising to reimburse affected traders. DebugBear urged RUM customers to remove its snippet.
The code ran in an already logged-in browser session, using the site’s authority to sell positions and move proceeds or send position tokens to an attacker-controlled address. The sample read some credential-related material, but Hudson Rock found no routine that sent passwords, seed phrases or private keys. The attacker could move value without first stealing them.
Hudson Rock found no evidence other DebugBear customers were targeted. For any authenticated app loading third-party browser code, that code shares the user’s session authority; removing it stops delivery but cannot establish which accounts or positions were already affected.
Polymarket halts trading after crypto-draining script breach, $2.5M traced
Prediction market platform Polymarket temporarily suspended trading on Thursday after hackers compromised a third-party service to distribute cryptocurrency-draining JavaScript, with approximately $2.5 million in assets traced to a suspected attacker wallet.