DebugBear's hijacked script drained $2.7m from Polymarket
Attackers swapped a file on DebugBear's CDN to drain traders on Polymarket. DebugBear has told every customer running its monitoring script to remove it while it investigates.
Attackers compromised a file on DebugBear’s CDN and swapped in malicious JavaScript, draining roughly $2.7 million from traders on the prediction market Polymarket. DebugBear’s product is a real user monitoring script that customers embed to measure page load speed for real visitors. On 29 October, the file it serves from that CDN was tampered with to do something else entirely.
The injected script read authentication data out of local storage, walked the page’s React tree to find Polymarket’s own trading functions, then signed transactions on each logged-in user’s behalf to sell their positions and route the proceeds to an attacker’s wallet. Roughly 700 wallets lost money before Polymarket paused trading and DebugBear told customers running its embed to pull it. DebugBear has confirmed the incident only in two short statements on social media and hasn’t yet said how its CDN was breached.
Why it matters: this didn’t touch Polymarket’s own code. The vulnerability sat entirely in a third-party script that had full access to the page, the same trust relationship your site has with every analytics, monitoring or chat widget you embed. If you run DebugBear’s RUM snippet, remove it until the incident is confirmed closed, and for any similarly privileged third-party script elsewhere, consider pinning it with Subresource Integrity rather than loading it live off someone else’s CDN.
The caveat: DebugBear hasn’t published a root-cause writeup, only short statements on X, so the entry point into its CDN is still unconfirmed.