How Third-Party Script Malware Drained $2.7 Million From Polymarket Users

The world of cybersecurity was shaken in late October 2026 when a sophisticated supply chain malware attack drained approximately $2.7 million from more than 700 Polymarket users in under an hour. The attack did not exploit a vulnerability in Polymarket’s own systems or smart contracts. Instead, attackers compromised a trusted third-party script from DebugBear, a UK-based website performance monitoring provider, turning a routine analytics tool into a weapon of financial theft.

The Anatomy of a Supply Chain Malware Attack

On October 29, 2026, visitors to the Polymarket international platform loaded what appeared to be a normal web page. Behind the scenes, however, a JavaScript file served from cdn.debugbear.com had been replaced with 15,187 bytes of malicious code instead of its usual 60,493 bytes of legitimate monitoring functionality. The compromised script was specifically designed to target Polymarket users, and it worked with alarming efficiency.

The malware checked for three specific localStorage keys that indicated an authenticated Polymarket session:

• polymarket.auth.params — containing authentication tokens
• polymarket.auth.proxyWallet — wallet connection data
• poly_clob_api_key_map — trading API credentials

If any of these were missing, the script silently bailed out. But if they were present, it walked the React component tree to find Polymarket’s own order client — the same object that legitimate trading operations use — and then exploited the user’s authenticated session to execute unauthorized transactions.

How the Malware Stole Funds

The attack was tailored to the specific wallet type each victim used:

Self-Custody Wallet Users

For users logged in with self-custody wallets like MetaMask, the malware executed a single safeBatchTransferFrom call to move all outcome tokens to a hardcoded attacker address. This was fast, efficient, and left almost no window for the victim to react.

Email-Based Account Users

For email-authenticated users, the malware was even more aggressive. It placed fill-and-kill sell orders at progressively lower prices — first at 97% of market price, then at 50%, and finally at the minimum tick. Any remaining cash balance was routed through Polymarket’s own Collateral Offramp contract, converted to POL tokens via fun.xyz and Relay, with the attacker listed as the recipient.

Every transaction went through Polymarket’s relayer and Deposit Wallet Factory, making the unauthorized activity look identical to legitimate trading. The malware even reported each victim’s portfolio value, IP address, country, and operating system back to data.debugbear.com/metrics/submit — a domain that the legitimate DebugBear product already communicated with.

The Scale and Timeline of the Attack

Blockchain analytics firm Bitquery traced approximately $2.73 million in unauthorized withdrawals across 737 accounts. The main attack window lasted roughly 50 minutes, from 17:10 to 18:10 UTC, during which attackers executed 985 operations through Polymarket’s existing infrastructure. Four accounts accounted for about 43% of the stolen amount, with the largest single withdrawal totaling $358,369. Another 276 accounts lost less than $100 each.

By 18:19 UTC, the attacker’s wallet held approximately 28.6 million POL tokens, valued at roughly $2.65 million. Polymarket shipped a production build at 17:59 UTC with a commit message removing the DebugBear script, but by then the damage was already done.

What Made This Attack So Dangerous

This incident highlights several characteristics that make supply chain malware particularly threatening:

• No direct breach required — The attackers never needed to compromise Polymarket’s servers. They simply poisoned a third-party dependency that Polymarket trusted.
• Blended with legitimate traffic — All transactions used Polymarket’s own relayer infrastructure, making detection extremely difficult.
• Session-based exploitation — The malware didn’t steal passwords or private keys. It hijacked the authority already present in an authenticated browser session.
• Broad exposure — Thousands of other websites loaded JavaScript from the same DebugBear CDN, meaning the attackers potentially had access to far more targets than just Polymarket.

Content Security Policy Failures

Security researchers noted that Polymarket’s Content Security Policy (CSP) allowed scripts from cdn.debugbear.com without additional integrity checks. When the CDN’s response headers changed from Google Cloud Storage fingerprints to nginx signatures, no CSP violation was triggered because the domain itself remained on the allowlist. This meant the malicious code executed with the same permissions as the legitimate monitoring script would have.

The lack of Subresource Integrity (SRI) hashes on the script tag meant there was no cryptographic verification that the served file matched the expected content. Had SRI been implemented, the browser would have refused to execute the tampered script.

Lessons for Web Application Security

The Polymarket attack offers critical lessons for any organization that embeds third-party scripts on its website:

Implement Subresource Integrity

Every external script should include an integrity attribute containing a cryptographic hash of the expected file. When the file content changes — whether through a legitimate update or a malicious compromise — the browser will refuse to execute it.

Adopt a Strict CSP

Content Security Policies should be as restrictive as possible. Rather than allowing entire domains, consider using nonces or hashes to whitelist specific scripts. This limits the blast radius if a trusted domain is compromised.

Monitor Third-Party Dependencies

Organizations should continuously monitor the scripts they load from external sources for unexpected changes in file size, content, or serving infrastructure. Anomalous header changes can be an early warning sign of compromise.

Minimize Session Authority

Web applications should limit what authenticated sessions can do without additional verification. Sensitive operations like fund transfers should require explicit user confirmation rather than relying solely on session validity.

The Broader Malware Landscape in 2026

The Polymarket attack is part of a broader escalation in malware sophistication throughout 2026. According to data from MalwareBazaar and ThreatFox, infostealers now account for 57% of all tracked malware samples, with Agent Tesla and Formbook showing surges of 161% and 165% respectively. Remote Access Trojans like AsyncRAT and Cobalt Strike have also seen significant increases, rising 66% and 600% in activity.

What sets the Polymarket attack apart is its use of a legitimate website monitoring tool as the delivery mechanism. Rather than relying on phishing emails or malicious downloads, the attackers poisoned a dependency that thousands of websites already trusted. This represents a shift from targeting individual users to targeting the infrastructure that serves them.

Polymarket’s Response and Recovery

Polymarket responded by removing the compromised DebugBear code, clearing caches, pausing trading, and resetting all active login sessions. The company referred the incident to UK law enforcement and pledged full reimbursement to affected users. By the following afternoon, Polymarket reported that 95% of affected wallets had been refunded, with a total of $3.9 million returned — $2.7 million for stolen funds and an additional $1.2 million to cover losses linked to the trading pause.

DebugBear acknowledged the security incident and urged all customers using its Real User Monitoring product to remove the embedded code from their websites. The company brought in specialist incident responders, though details of the compromise remain under investigation.

Conclusion

The Polymarket supply chain malware attack demonstrates that even well-secured platforms can be compromised through their trusted dependencies. As web applications increasingly rely on third-party scripts for analytics, monitoring, and functionality, the attack surface grows in ways that traditional security measures may not cover. Organizations must treat every external script as a potential risk, implement integrity verification, and maintain vigilant monitoring of their supply chain. In an era where a single compromised CDN file can drain millions in minutes, proactive defense is no longer optional — it is essential.

---

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous