How a Hijacked Analytics Script Drained $2.7M From Polymarket in Under an Hour
On October 29, 2026, threat actors compromised Polymarket's prediction-market platform by hijacking a third-party performance-monitoring script served by DebugBear. Attackers manipulated DebugBear's DNS records through its domain registrar, redirecting Polymarket's copy of the RUM script to a malicious server. The injected code exploited already-authenticated browser sessions, harvesting trading API keys and co-opting each account's own transaction signer to drain positions and funds. Within 52 minutes, approximately $2.64 million in POL tokens were swept from 726 wallets into attacker-controlled addresses before Polymarket halted trading. Polymarket subsequently refunded roughly $3.9 million to affected and indirectly impacted traders. This incident illustrates the escalating risk of third-party script injection as an attack surface for financial platforms. As decentralized-finance and prediction-market adoption grows, supply-chain compromises targeting CDN-delivered JavaScript represent a high-yield, low-footprint tactic that bypasses perimeter defenses entirely, accelerating regulatory scrutiny of Web3 platform dependencies.
Kill Chain
