Polymarket confirms third-party breach; researchers find wallet-draining DebugBear script
Polymarket confirmed a compromised provider and promised reimbursement. Hudson Rock found asset-theft code in a DebugBear script targeting logged-in traders. Trading has resumed; total losses and the affected population remain unverified.
- Disclosed
- Oct 29, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Logged-in Polymarket.com users exposed to the malicious script; DebugBear RUM customers should remove its embed
- web
- In the wild
- Yes
- Polymarket confirms a provider compromise and reimbursement for affected users.
What happened
Polymarket’s international platform confirmed a compromised provider on October 29 and committed to compensating affected users. Its status page now records the outage as resolved. L4 reflects a real compromise, rather than a theoretical vulnerability.
Hudson Rock attributes the malicious script to a DebugBear delivery URL. The sample reuses the logged-in application’s trading client and signer to attempt position transfers or sales and subsequent asset transfers. This does not prove every signing request silently succeeds, private keys were exported, or smart contracts were compromised. Removing the script does not establish that every already-open session is safe.
The platform’s notice does not name its provider; DebugBear separately acknowledges an incident. The precise exposure window, initial access and total affected population remain unknown. Neither reported wallet balances nor individual loss claims establish aggregate stolen funds. This is a separate October event; June incident figures must not be reused for it.
Crime-scene timeline
Oct 29, 18:05 UTC
Polymarket pauses new trades and relayer actions
Oct 29, 18:37 UTC
Polymarket confirms the provider compromise and promises reimbursement
Oct 29, 19:05 UTC
Official status history marks the incident resolved
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Polymarket official status historyPrimaryRecords the October 29 pause, provider compromise, reimbursement commitment and resolution, with explicit UTC timestamps.
- Hudson Rock researchPrimaryStatic analysis identifies session reuse and asset-transfer logic; indicators and financial-evidence limitations were read in the publicly indexed report. Direct page retrieval returned 403.
- DebugBear security noticeOriginal vendor notice; read through the official X embed below.
- Official X embed of DebugBear's noticePrimaryDebugBear confirms an ongoing security incident and tells RUM customers to remove its embed code.