polymarket debugbear Breach: $2.7M Drained, $3.9M Repaid
The polymarket debugbear breach let a hijacked vendor script drain about $2.7M from 726 wallets; Polymarket is returning $3.9M including pause-related losses.
Early story. Some claims here are not officially confirmed yet. We update this post as it confirms.
- CNBC's source said the breach came through DebugBear, a UK-based website performance monitoring service.
- Bankless reported 726 hit wallets, with 689 fully repaid by Friday morning and the rest pending verification.
- Polymarket's U.S. platform was not affected, and its smart contracts were not the problem.
in this block
The polymarket debugbear incident turned a boring web-performance script into a wallet drainer. On October 29, attackers compromised a third-party monitoring script loaded by Polymarket's international site, hijacked logged-in sessions for about an hour, and pulled roughly $2.7 million from hundreds of accounts. Polymarket says it is returning $3.9 million in total, including compensation for losses tied to the trading pause.
What actually happened
Polymarket's status page tells the timeline. At 6:05 PM UTC on October 29 (21:05 MSK), the exchange went into cancel-only mode with relayer actions paused. By 6:37 PM UTC the team said it had identified and fixed the issue, noting that "one of our third party providers was compromised." Trading resumed around 3 p.m. ET, and the incident was marked resolved at 7:05 PM UTC.
The mechanism came out over the next day. Bankless, citing security researcher Scott Helme, reported that a page-speed monitoring script served from DebugBear's CDN was swapped for a drainer. For roughly an hour it hijacked sessions, dumped or moved positions, and swept cash out through Polymarket's own relayer. A person familiar with the matter told CNBC the source was DebugBear, which confirmed on X that it had a security incident.
Analytics firms Betting Intelligence and Polysights told CNBC an account withdrew at least $2.7 million across more than 700 wallets. Polymarket referred the case to UK law enforcement, since that is where DebugBear is based.
Who got hit and how they are being repaid
Bankless reported that most victims were small: the median account lost about $171, per Bitquery's analysis. But four accounts that each lost more than $100,000 made up about 43% of the total.
Polymarket said it is returning $3.9 million: the $2.7 million stolen plus about $1.19 million for roughly 5,500 wallets that lost out during the pause or had positions taken. CNBC reported that users who lost under $10,000 would be restored by October 30, while larger victims must sign a release form. Bankless said terms shared by users, including ID checks and a broad non-disparagement clause, drew pushback.
The polymarket debugbear breach is a supply-chain hack, not a smart-contract hack. That is exactly why it is scary.
Why this matters for every crypto frontend
This is reportedly the second time since June that a compromised vendor injected malicious code into Polymarket's frontend, per Bankless. Helme argued that the site's security policy allowed every domain the drainer touched, and that pinning the script to a known hash would have blocked the swapped file.
That lesson applies far beyond one prediction market. Any app that loads outside scripts on pages where users sign transactions shares this exposure. We have tracked Polymarket's product shifts in polymarket v2 and the trader side in galaxy polymarket retail losses; this incident adds a security chapter right before the U.S. midterms, its busiest week.
What Polymarket still needs to explain
The company has promised a postmortem. Traders will want to know exactly which scripts the site loads, whether they are now pinned or removed, and how the relayer let a hijacked session move funds without extra checks. Clear answers there matter more than the refund total.
The timing is tough. The polymarket debugbear breach landed days before one of the biggest event cycles of the year, when new users are most likely to show up and least likely to know the risks.
What to do as a reader
If you trade on Polymarket's international site, check your activity history for positions or withdrawals you did not make on October 29. Use only the official Polymarket status page and verified accounts for updates on reimbursements.
Read any release form carefully before signing, especially clauses about disclosure or future claims. If something feels off, ask in official channels before you agree.
Log out of sessions you are not using, and consider a separate browser profile for trading apps. A hijacked session does not need your seed phrase to do damage.
Expect phishing that piggybacks on the polymarket debugbear news, such as fake "refund portal" links. Polymarket says affected users will be made whole without you having to connect a wallet to random sites. Nothing here is investment advice.
Not financial advice. DYOR, ser.
