# Polymarket Third-Party Script Compromise: Wallet-Draining Code Served via DebugBear RUM Script

> Hudson Rock reports that a DebugBear real-user-monitoring script (cdn.debugbear.com/C7xcKKrjUnXK.js) loaded on Polymarket contained wallet-draining JavaScript that hijacked authenticated trading sessions, enumerated portfolios and attempted to move assets to an attacker-controlled wallet. One trader reported an $800,000 loss on 2026-10-29; aggregate losses and the number of victims are unverified.

- **Published:** 2026-10-29T19:03:52Z
- **Last reviewed:** 2026-10-29T19:03:52Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4764
- **ID:** TL-2026-4764
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-29 Hudson Rock (InfoStealers) published static analysis of a JavaScript file (15,187 bytes, SHA-256 0755e767504d8103f6c27b9e765a1026507a17c04513242adb503df7777879e5) served from cdn.debugbear.com/C7xcKKrjUnXK.js, a DebugBear real-user-monitoring (RUM) script that was embedded in Polymarket's web application. The file behaved as a wallet drainer rather than a performance monitor.

Reported behavior: the script read three localStorage entries holding authentication context (polymarket.auth.params, polymarket.auth.proxyWallet, poly_clob_api_key_map); traversed React component structures to locate trading-client methods such as postOrder and createOrder and attempted to use the user's authenticated signer; queried balances and positions, applying configurable thresholds (default 10 for total value and per-position) and checking geoblocking status; for externally owned account (EOA) users constructed ERC-1155 batch transfers to a hardcoded recipient address; for Magic wallet users submitted SELL orders at escalating prices before attempting balance transfers; and exfiltrated wallet addresses, IP information, portfolio values and transfer results to data.debugbear.com via /metrics/submit, /metrics/update and /metrics/handle. Configuration was fetched from /metrics/init. A hardcoded tracking ID (4c6b64a0-a7ef-4c0f-9c70-3a4e6f89065c) was present.

Timeline per the report (UTC, 2026-10-29): Polymarket's production build removing the DebugBear script was timestamped 17:59:20 (commit f908fe564ea73067b09ab1f0c5d683970020fbca); the researcher retrieved the payload at 18:12:06 and again at 18:13:04 (identical), and a homepage snapshot at that time showed no DebugBear reference. The exposure window start is not established; the hunt rationale estimated 2026-10-27, which is not confirmed by the article's published text. A trader identified as 'Car' reported an $800,000 account drain with all positions liquidated. The hardcoded recipient wallet showed roughly $2.19 million in POL and tokens ($2,178,191.78 POL plus $16,170.39 tokens), but this cannot be verified as exclusively stolen funds.

Limitations: this is a single-source report based on static analysis; no victim-to-recipient transaction tracing was performed, execution success across all code paths is unconfirmed, and signing requests in the code do not guarantee silent approvals. The initial compromise vector (whether DebugBear's CDN/account was compromised, the file was spoofed, or Polymarket's loader reference was altered) is unknown, whether other DebugBear customers were affected is unknown, no attribution exists, and no statements from Polymarket or DebugBear were available at the time of the article. A separate incident on 2026-06-25, in which roughly $3 million was drained from Polymarket users via an unnamed compromised third-party vendor script, is reported elsewhere; the sources reviewed do not link it to this event and cside's analysis did not name DebugBear, so the two should not be assumed related.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1059.007 JavaScript
- T1036 Masquerading
- T1528 Steal Application Access Token
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1657 Financial Theft

## Sources

- [Polymarket Breach Alert: Wallet-Draining Code Found in a Third-Party Script](https://www.infostealers.com/article/polymarket-breach-alert-wallet-draining-code-found-in-a-third-party-script/)
- [Polymarket client-side supply chain attack (cside) - related June 2026 incident](https://cside.com/blog/polymarket-client-side-supply-chain-attack)
- [Polymarket customers lose $3 million in supply-chain attack (BleepingComputer) - related June 2026 incident](https://www.bleepingcomputer.com/news/security/polymarket-customers-lose-3-million-in-supply-chain-attack/)
- [Polymarket hack: $3 million stolen via third-party breach (The Next Web) - related June 2026 incident](https://thenextweb.com/news/polymarket-hack-3-million-stolen-third-party-breach)
- [Polymarket Confirms Front-End Supply-Chain Breach and Pledges Full Refunds (DEXTools) - related June 2026 incident](https://www.dextools.io/news/polymarket-frontend-supply-chain-breach-refund-june-2026)
- [Polymarket customers lose $2.97 million, company blames third-party vendor (Web3 is Going Great) - related June 2026 incident](https://web3isgoinggreat.com/single/polymarket-vendor-exploit)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4764