Polymarket will refund €3.6 million after a hijacked DebugBear script drained traders
A malicious replacement for DebugBear’s page-monitoring script used signed-in Polymarket traders’ existing access to move funds and positions on 29 October. Polymarket says 726 wallets were affected and it is returning €3.6 million ($3.9 million), including compensation for losses during a trading pause; DebugBear says its DNS records were compromised through its domain registrar.
Bottom line — Polymarket says it is adding stronger script checks after the breach, which sent about €2.4 million ($2.64 million) in POL to the attackers’ wallet.
Go deeper 6
-
Hudson Rock found no code that sent passwords, seed phrases or private keys to the attacker; the script instead reused access within logged-in sessions.
-
DebugBear says early findings point to one customer website and show no sign its own systems were breached; its investigation continues.
-
Ohey’s blockchain trace recorded POL and trading positions from 33 wallets, while Polymarket reported 726 affected wallets; the articles do not reconcile the counts.
-
Polymarket said it removed the script, cleared caches, reset active sessions and paused trading until the site was clean.
-
By 30 October, Polymarket had refunded 689 of the 726 affected wallets, according to the reporting.
-
Polymarket says it is restoring third-party scripts with stronger checks, including pinned versions, sandboxing and a stricter Content Security Policy.