Polymarket will return $3.9 million to traders affected by an October 29 supply-chain attack in which malicious JavaScript served through website-monitoring provider DebugBear sold positions and transferred digital assets from logged-in users. The prediction-market operator said the incident affected 726 wallets and that 95% had been refunded in full by October 30, according to its official incident update.
The payment includes approximately $2.7 million tied to directly drained wallets and another $1.19 million for traders harmed by the trading suspension or by positions that were force-sold or transferred during the incident. Polymarket said it identified eligible wallets from on-chain and trading data, so users did not need to submit claims. The company also said refunds for force-sold positions would account for the value at the time of removal, including slippage.
Polymarket halted trading on its international platform after users reported unauthorized withdrawals. Researchers at Hudson Rock linked the activity to a JavaScript file delivered from cdn.debugbear.com, an address associated with DebugBear’s real-user-monitoring service. The script searched for an active Polymarket trading client, inspected portfolios and attempted either to sell positions and redirect the proceeds or transfer position tokens to an attacker-controlled wallet, according to technical reporting by BleepingComputer [18].
DebugBear said its DNS records were compromised through its domain registrar and that it was temporarily unable to receive email sent to its domain. The company’s preliminary findings indicated that attackers appeared to target a single customer website, while it found no indication that its own internal systems had been breached. DebugBear has not publicly explained how the registrar account was accessed, and the investigation remains ongoing. It initially urged customers using its real-user-monitoring embed to remove the snippet.
The incident illustrates how a trusted third-party script can execute with the privileges available to a user’s open session, even when the primary website itself has not been compromised. Polymarket said it removed the provider within an hour, resumed normal trading after the disruption and referred the matter to law enforcement. Organizations using externally hosted JavaScript should inventory such dependencies, review registrar and DNS-account protections, pin or self-host critical scripts where practical, and monitor browser sessions and wallet activity for unauthorized transactions. No CVE or public exploit classification has been identified for this incident; the available evidence describes a targeted DNS and third-party-script compromise rather than a disclosed software vulnerability.
