Polymarket halts trading after crypto-draining script breach, $2.5M traced
Hudson Rock linked a wallet in DebugBear-hosted JavaScript to about 28.6 million POL, roughly $2.57 million.
Polymarket suspended trading on Thursday after a compromised third-party service served cryptocurrency-draining JavaScript to users of Polymarket.com. The company said it fixed the issue, referred it to law enforcement, and will reimburse affected traders; trading resumed about an hour later and was marked resolved at 3:05 p.m. ET. Researchers say the script, hosted on DebugBear infrastructure, hijacked logged-in sessions to liquidate positions and move assets. Polymarket has not said how many users were hit or how much was stolen.
Unconfirmed: Polymarket has not confirmed the stolen total, user count, or reimbursement process; whether DebugBear's site outage is containment-related is unclear.
- The exchange entered cancel-only mode at 2:05 p.m. ET and paused relayer actions.
- Malicious script was served from cdn.debugbear[.]com/C7xcKKrjUnXK.js and used data.debugbear.com.
- Suspected wallet 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18 held about $2.19 million during the review.
- DebugBear told Real User Monitoring customers to remove its embed code.
- A production build removed the DebugBear script at 1:59 p.m. ET on October 29.
Impact: User crypto and prediction-market holdings drained
| Product | Affected |
|---|---|
| DebugBear Real User Monitoring | — |
- 1.Remove the DebugBear Real User Monitoring embed code from websites
- Vendors
- DebugBear
- Victims
- Polymarket
- Organizations
- Hudson Rock
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | data.debugbear.com | gComputer found that the malicious script communicated with data.debugbear.com to receive instructions and send data about targeted accoun |
| domain | debugbear.com | ock identified malicious JavaScript distributed through cdn.debugbear[.]com/C7xcKKrjUnXK.js that was designed to steal cryptocurrency |
From the original article
3 min read at bleepingcomputer.com
Prediction market platform Polymarket temporarily suspended trading on Thursday after hackers compromised a third-party service to distribute cryptocurrency-draining JavaScript, with approximately $2. 5 million in assets traced to a suspected attacker wallet. [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.