Polymarket has published its postmortem of the 29 October attack in which a swapped-in website script drained traders’ accounts, and says it is returning $3.9 million to traders without requiring any claim. According to The Hacker News, about $2.7 million went back to 726 drained wallets, and about $1.19 million went to roughly 5,500 more wallets that lost money during the trading pause or had positions taken. Polymarket’s own update, dated 30 October, says 95% of affected wallets had been refunded in full by that afternoon; The Hacker News counted 689 of 726 refunded, with the other 37 being paid as they were checked. Our earlier post noted that Polymarket had not yet said how reimbursement would work.
The cause is now clearer. Polymarket says a third-party vendor’s performance-monitoring script was compromised and replaced with one built to target its users. The Hacker News reports that DebugBear, the vendor, said on X that its DNS records were compromised through its domain registrar, that early findings point to an attack on one customer’s website, and that it has seen no sign of a break-in to its own systems (its investigation was continuing). Security firm Ohey, which analysed a captured copy of the script, found it ran in logged-in sessions between 16:54 and 17:59 UTC, borrowed Polymarket’s own trading client from the page, signed transfers with the account’s existing signer, and submitted them through Polymarket’s own relayer. Ohey also noted that every host the script contacted, apart from DebugBear’s, was already on Polymarket’s Content Security Policy (CSP) allow-list.
Polymarket says it has removed the script, cleared caches, reset all active login sessions, referred the case to law enforcement and is redeploying third-party scripts with stronger CSP, pinned versions and sandboxing. The Hacker News says that when it checked on 1 November, the address that served the malicious file had no DNS record. Figures for the theft differ by method: Ohey counted 28.6 million POL tokens plus positions from 33 accounts reaching the attacker’s wallet, while others cited by Ohey traced about $2.6 to $2.7 million from several hundred source wallets.
How to check if you’re affected
Affected products are Polymarket accounts that were signed in around 29 October and any website that loads DebugBear’s real-user-monitoring (RUM) script.
- If you traded on Polymarket on 29 October: Polymarket says eligible wallets were identified from on-chain and trading data, so no ticket or claim is needed. If you think your amount is wrong or you should have received a payment, its status page links a form for a recheck. Reject any wallet signing request you did not expect, which is Hudson Rock’s advice for traders as reported by The Hacker News.
- If you run a website that loads third-party scripts on signed-in pages: DebugBear told RUM customers to remove its embed code. Ohey lists these indicators: the script URL
cdn.debugbear[.]com/C7xcKKrjUnXK.jsand the drainer’s SHA-2560755e767504d8103f6c27b9e765a1026507a17c04513242adb503df7777879e5. Hudson Rock’s advice for sites, as reported by The Hacker News, is to keep unneeded third-party code off pages where users trade or sign, to pin files with Subresource Integrity (SRI) where possible, and to remember that a CSP that merely allows a trusted CDN does not check what that CDN serves.