Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script

Hackers stole approximately $2.7 million from Polymarket traders by injecting malicious code into a third-party page-speed script provided by DebugBear. The attack occurred on October 29, 2026, targeting signed-in traders by selling their positions and transferring funds to attacker-controlled wallets. A total of 726 wallets were affected, with blockchain records confirming approximately $2.64 million in crypto was moved. Polymarket has committed to refunding the affected users. This incident represents a classic supply chain attack where a trusted external script was compromised and weaponized. The attack highlights the risks of loading third-party scripts in financial and cryptocurrency platforms. No CVEs have been publicly associated with this incident at this time.