Polymarket front end via DebugBear script (October 2026) hack — October 2026

On 29 October 2026 users of Polymarket.com, the prediction market’s international site, began reporting in its Discord that funds were leaving their accounts without permission. At 18:00 UTC DebugBear, a company that sells web-performance monitoring, said it was affected by an ongoing security incident and told customers of its real-user monitoring product to remove its embed code from their websites. Polymarket loaded that script. Six minutes later Polymarket put the exchange into cancel-only mode and paused relayer actions.

At 18:33 UTC Polymarket said one of its third-party providers had been compromised, that the issue was fixed, that it had referred the matter to law enforcement and that anyone affected would be made whole. Trading reopened at about 19:00 UTC, with Polymarket saying it was fully reimbursing all affected traders. Changpeng Zhao described the mechanism as a front-end injection that put an incorrect transaction in front of users while showing them a valid one to sign; 0xngmi of DefiLlama said wallet seed phrases were not exposed.

The analyst Conor Grogan counted 995 drained accounts and $2,654,211.42 at the attacker’s address, with the largest single losses at about $341,000 and $307,000, and said the attacker had converted everything to POL, most likely to avoid stablecoin freezes. 0xngmi tracked about $2.7 million. This is Polymarket’s second front-end supply-chain incident of 2026, after the vendor compromise of June. Reimbursement had been promised but not confirmed as paid on the day of recording.