Threat reportSupply ChainTL-2026-4764
Polymarket Third-Party Script Compromise: Wallet-Draining Code Served via DebugBear RUM Script
Polymarket Third-Party Script Compromise (TL-2026-4764) is a high-severity supply-chain compromise, first published 2026-10-29. It has no confirmed attribution, affects Polymarket Polymarket web trading application, maps to 7 MITRE ATT&CK techniques (T1005, T1036, T1059.007), and is covered by 9 detection rules and 10 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-4764
- Threat ID
- TL-2026-4764
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, cryptocurrency, prediction-markets
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 10
How Polymarket Third-Party Script Compromise works
Hudson Rock reports that a DebugBear real-user-monitoring script (cdn.debugbear.com/C7xcKKrjUnXK.js) loaded on Polymarket contained wallet-draining JavaScript that hijacked authenticated trading sessions, enumerated portfolios and attempted to move assets to an attacker-controlled wallet. One trader reported an $800,000 loss on 2026-10-29; aggregate losses and the number of victims are unverified.
On 2026-10-29 Hudson Rock (InfoStealers) published static analysis of a JavaScript file (15,187 bytes, SHA-256 0755e767504d8103f6c27b9e765a1026507a17c04513242adb503df7777879e5) served from cdn.debugbear.com/C7xcKKrjUnXK.js, a DebugBear real-user-monitoring (RUM) script that was embedded in Polymarket's web application. The file behaved as a wallet drainer rather than a performance monitor.
Reported behavior: the script read three localStorage entries holding authentication context (polymarket.auth.params, polymarket.auth.proxyWallet, poly_clob_api_key_map); traversed React component structures to locate trading-client methods such as postOrder and createOrder and attempted to use the user's authenticated signer; queried balances and positions, applying configurable thresholds (default 10 for total value and per-position) and checking geoblocking status; for externally owned account (EOA) users constructed ERC-1155 batch transfers to a hardcoded recipient address; for Magic wallet users submitted SELL orders at escalating prices before attempting balance transfers; and exfiltrated wallet addresses, IP information, portfolio values and transfer results to data.debugbear.com via /metrics/submit, /metrics/update and /metrics/handle. Configuration was fetched from /metrics/init. A hardcoded tracking ID (4c6b64a0-a7ef-4c0f-9c70-3a4e6f89065c) was present.
Timeline per the report (UTC, 2026-10-29): Polymarket's production build removing the DebugBear script was timestamped 17:59:20 (commit f908fe564ea73067b09ab1f0c5d683970020fbca); the researcher retrieved the payload at 18:12:06 and again at 18:13:04 (identical), and a homepage snapshot at that time showed no DebugBear reference. The exposure window start is not established; the hunt rationale estimated 2026-10-27, which is not confirmed by the article's published text. A trader identified as 'Car' reported an $800,000 account drain with all positions liquidated. The hardcoded recipient wallet showed roughly $2.19 million in POL and tokens ($2,178,191.78 POL plus $16,170.39 tokens), but this cannot be verified as exclusively stolen funds.
Limitations: this is a single-source report based on static analysis; no victim-to-recipient transaction tracing was performed, execution success across all code paths is unconfirmed, and signing requests in the code do not guarantee silent approvals. The initial compromise vector (whether DebugBear's CDN/account was compromised, the file was spoofed, or Polymarket's loader reference was altered) is unknown, whether other DebugBear customers were affected is unknown, no attribution exists, and no statements from Polymarket or DebugBear were available at the time of the article. A separate incident on 2026-06-25, in which roughly $3 million was drained from Polymarket users via an unnamed compromised third-party vendor script, is reported elsewhere; the sources reviewed do not link it to this event and cside's analysis did not name DebugBear, so the two should not be assumed related.
MITRE ATT&CK techniques used in TL-2026-4764
Collection
Defense Evasion
Execution
Command and Control
Initial Access
T1195.002 Compromise Software Supply Chain
Credential Access
T1528 Steal Application Access Token
Impact
Affected products and versions in Polymarket Third-Party Script Compromise
- Polymarket — Polymarket web trading application
Vulnerable versions: Builds loading cdn.debugbear.com/C7xcKKrjUnXK.js before the 2026-10-29 17:59 UTC production build (commit f908fe564ea73067b09ab1f0c5d683970020fbca)
Fixed in: Production build removing the DebugBear script reference - DebugBear — DebugBear real-user-monitoring (RUM) script / CDN
Vulnerable versions: cdn.debugbear.com/C7xcKKrjUnXK.js (SHA-256 0755e767504d8103f6c27b9e765a1026507a17c04513242adb503df7777879e5)
Remediation for Polymarket Third-Party Script Compromise
Immediate actions
- Remove or disable DebugBear and any non-essential third-party scripts from authenticated trading and wallet-signing pages
- Block data.debugbear.com /metrics/submit, /metrics/update and /metrics/handle and the hash 0755e767504d8103f6c27b9e765a1026507a17c04513242adb503df7777879e5 where the script may still be cached
- Users: close Polymarket tabs open during the exposure window, reject unexpected signing requests, review sessions, API credentials and wallet token approvals, and revoke where needed
- Preserve exact response bytes, hashes, HTTP metadata and loader references from CDNs before they change
- Monitor on-chain activity for transfers to 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18
Workarounds
- Self-host a vetted copy of the monitoring script with pinned hash instead of loading it live from a third-party CDN
- Never share seed phrases and avoid unsolicited recovery links
Longer-term hardening
- Enforce Subresource Integrity (SRI) and a restrictive Content Security Policy (script-src, connect-src) on authenticated pages
- Audit signer boundaries so untrusted third-party code cannot reach signing interfaces or authenticated clients
- Do not store API keys or auth parameters in localStorage readable by third-party scripts; isolate monitoring scripts in sandboxed iframes or self-host reviewed copies
- Deploy client-side script monitoring to detect changes in third-party JavaScript at runtime
- Verify executable dependencies rather than trusting domain names alone
Weaknesses (CWE) in Polymarket Third-Party Script Compromise
Timeline of Polymarket Third-Party Script Compromise
- Separate, previously reported Polymarket incident: roughly $3 million drained from users via an unnamed compromised third-party vendor script; Polymarket pledged reimbursement. Not linked to DebugBear in the reviewed sources.
- Estimated start of exposure window per platform hunt estimate; the Hudson Rock article states exposure boundaries are undefined, so treat as unconfirmed.
- Hudson Rock (InfoStealers) published analysis of the wallet-draining code; no statements from Polymarket or DebugBear were included.
- Researcher retrieved the payload from cdn.debugbear.com/C7xcKKrjUnXK.js at 18:12:06 UTC and again at 18:13:04 UTC with identical content (15,187 bytes); homepage snapshot showed no DebugBear reference.
- Polymarket production build timestamped 17:59:20 UTC (commit f908fe564ea73067b09ab1f0c5d683970020fbca) removed the DebugBear script reference.
- A trader identified as 'Car' reported an $800,000 account drain with all positions liquidated.
Sources cited for Polymarket Third-Party Script Compromise
- Polymarket Breach Alert: Wallet-Draining Code Found in a Third-Party Script
- Polymarket client-side supply chain attack (cside) - related June 2026 incident
- Polymarket customers lose $3 million in supply-chain attack (BleepingComputer) - related June 2026 incident
- Polymarket hack: $3 million stolen via third-party breach (The Next Web) - related June 2026 incident
- Polymarket Confirms Front-End Supply-Chain Breach and Pledges Full Refunds (DEXTools) - related June 2026 incident
- Polymarket customers lose $2.97 million, company blames third-party vendor (Web3 is Going Great) - related June 2026 incident
Detection coverage for TL-2026-4764
As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4764 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.