Polymarket refunds $2.7 million after a hijacked DebugBear script

A page-speed script on Polymarket was replaced on October 29, 2026, and signed-in traders lost positions. The company’s public figure is a refund of about $2.7 million across 726 wallets. The tag came from DebugBear, whose real-user monitoring product times how fast a page loads. A public chain trace puts about $2.64 million of one token into an attacker wallet inside an hour. That sum is the token. Other positions sit in the wider refund.

What the two companies have said

DebugBear says the DNS records for its service were changed at the domain registrar. The early account is that one customer’s site was the target. The company says it has not found a break-in on its own systems and is still looking. Customers of the monitoring product have been told to take the embed off their pages. When reporters checked on November 1, the hostname that had served the file no longer resolved.

Polymarket’s first public note about unauthorized activity in user wallets went up at 17:38 UTC. At 18:05 UTC the exchange was in cancel-only mode and the piece that submits signed actions was paused. The company says the tag was gone inside the hour, caches were emptied, live sessions were ended, and trading stayed stopped until the page was clean. The case has been referred to law enforcement.

Hudson Rock saved a copy of the file the site was loading that day, and later saw Polymarket’s own markup drop the tag. Ohey reported a different server answering for DebugBear’s names at 18:13 UTC, while that file was still online. Earlier the same day the ordinary script had been coming from Google Cloud Storage. Each DebugBear customer loads a separate copy. The copy that changed was Polymarket’s.

The hour the funds moved

In Ohey’s trace, the collecting wallet took its first transfer at 17:10 UTC and its last at 18:02 UTC. Across that window it gathered 28.6 million POL, plus positions, from 33 wallets. At 18:19 UTC those POL tokens priced out to about $2.64 million on the DefiLlama quote DefiPrime used. From 18:28 to 18:38 UTC the same wallet forwarded the POL on to three further addresses.

Polymarket’s refund list is wider than that one trace. By October 30 the company said 689 of the 726 affected wallets had been paid in full, with the other 37 still being checked. It is also paying $1.19 million to about 5,500 wallets that lost money while trading was halted or had positions taken. The combined return is $3.9 million. Traders do not file a claim. A form on the status page is there for anyone who thinks the amount is wrong.

Hudson Rock read the file and did not run it. The public description says the script works inside a page the trader has already opened, and that the reviewers did not find it sending a seed phrase, a password, or a private key to the server it contacts. An order on Polymarket still needs the account’s own signer. A prompt can still appear, and the wallet vendor can still refuse it. The layout of that file is a research note. It is not a checklist for this desk.

What to change on a signed-in page

Every third-party script on a trading or signing page has production authority. A page-speed tag can move money if the browser will run whatever that host returns. Drop tags those pages do not need. Where a file can be pinned, subresource integrity lets the browser refuse a body that no longer matches the hash you shipped. A content-security policy that only names a vendor hostname does not inspect the bytes that hostname serves. Pin versions. Sandbox what you can.

Inventory which script on an authenticated page is allowed to reach the signer. A registrar or DNS change at a vendor you embed is your incident too. Watch those records, and keep a way to strip the tag without a deploy argument.

Anyone trading should dismiss a signature request they did not start. Reading the book is not a reason to approve a movement of positions. If a prompt appears during an ordinary page load, refuse it and leave the tab.

Polymarket says outside scripts are going back only with a tighter content-security policy, pinned versions, and sandboxing. That is the control that belongs on the page before a registrar record moves.

This briefing relies on public reporting by The Hacker News and on statements from Polymarket, DebugBear, Hudson Rock, and Ohey. It does not include exploit procedures.