Polymarket Hacked via Compromised DebugBear RUM Script

Executive Summary

On October 29, 2026, the international prediction market Polymarket experienced a significant security incident, resulting in the theft of approximately $2.71 million from user accounts. The attack was a sophisticated supply chain compromise originating from a third-party service provider, DebugBear, a website performance monitoring firm. Attackers injected malicious JavaScript into DebugBear's Real User Monitoring (RUM) script, which was loaded by Polymarket's frontend. This script hijacked active, authenticated user sessions to liquidate positions and exfiltrate funds. Polymarket quickly halted trading, isolated the issue, and has committed to making all affected users whole. The incident highlights the critical risks associated with third-party scripts and the need for robust supply chain security monitoring.

Threat Overview

The attack began when users of Polymarket.com started reporting unauthorized withdrawals from their accounts. The investigation traced the root cause to a malicious update to a JavaScript file served by DebugBear. This script, intended for performance monitoring, was altered to include code that specifically targeted Polymarket users.

• Attack Vector: The primary vector was a Supply Chain Attack (T1195.001 - Compromise Software Dependencies and Development Tools). The attackers did not breach Polymarket directly but instead compromised one of its upstream dependencies.
• Mechanism: The malicious script executed within the context of a user's authenticated browser session. It did not steal passwords or private keys. Instead, it used the existing session's authority to interact with the platform's trading functions, selling off user positions and transferring the resulting funds to attacker-controlled wallets.
• Attribution: The threat actors behind the compromise of DebugBear and the subsequent attack on Polymarket remain unidentified.

Technical Analysis

The attack's sophistication lies in its ability to abuse trust and functionality rather than brute-forcing access. The malicious JavaScript was designed to be stealthy and effective.

1. Compromise: The attackers first gained access to DebugBear's infrastructure, allowing them to modify the RUM script.
2. Injection: A malicious payload was prepended or embedded within the legitimate rum.js script.
3. Execution: When a logged-in Polymarket user loaded the page, their browser fetched and executed the compromised script.
4. Action on Objectives: The script would detect the active session, access the trading portfolio, and programmatically execute sell orders or transfer tokens. This is a form of session hijacking, leveraging the trust the Polymarket application had in the user's browser session.

MITRE ATT&CK Techniques

• T1195.001 - Compromise Software Dependencies and Development Tools: The core of the attack involved compromising a third-party software provider (DebugBear) to distribute malicious code.
• T1059.007 - JavaScript: Malicious JavaScript was the payload used to carry out the unauthorized actions.
• T1189 - Drive-by Compromise: Users were compromised simply by visiting the legitimate Polymarket website, which loaded the malicious third-party script.
• T1496 - Resource Hijacking: The attack hijacked the user's session and financial resources (account funds) for the attacker's benefit.

Impact Assessment

The direct financial impact was the theft of approximately $2.71 million, as reported by blockchain security firm GoPlus. Polymarket's swift response to halt trading likely prevented further losses. The reputational damage to both Polymarket and DebugBear is significant. For Polymarket, it raises questions about its vendor risk management processes. For DebugBear, it severely undermines the trustworthiness of its service. Polymarket's promise to fully reimburse victims will mitigate some user-facing financial harm but represents a substantial cost to the company.

IOCs — Directly from Articles

No specific file hashes, domains, or IP addresses were mentioned in the source articles.

Cyber Observables — Hunting Hints

The following patterns could indicate related activity:

Detection & Response

Detecting this type of attack is challenging as it leverages legitimate, trusted channels.

• Detection: Implementing Subresource Integrity (SRI) is a primary defense. SRI allows a website to verify that a third-party script has not been tampered with by checking its hash. Monitoring for changes in the behavior of third-party scripts, such as new network connections or unexpected DOM manipulation, can also provide signals. D3FEND techniques like D3-WSAA: Web Session Activity Analysis are critical for spotting anomalous in-session behavior.
• Response: Polymarket's response was appropriate: they quickly identified the issue, halted operations to prevent further damage, removed the compromised dependency, and communicated transparently with users. DebugBear advised all customers to immediately remove the RUM script snippet from their sites.

Mitigation

• Subresource Integrity (SRI): This is the most direct technical control. Websites should include an integrity attribute in their <script> tags for all third-party resources. This ensures the browser only executes the script if it matches a known, trusted hash.
• Content Security Policy (CSP): A strict CSP can limit the domains from which scripts can be loaded and to which network requests can be made, potentially blocking the exfiltration step.
• Vendor Risk Management: Organizations must rigorously vet third-party code and services. This includes reviewing their security practices and having contractual obligations for security incidents.
• Sandboxing: Where possible, third-party scripts should be run in a sandboxed environment (e.g., an iframe with restricted permissions) to limit their access to the main application's data and functions. This aligns with D3FEND's D3-ACH: Application Configuration Hardening.