Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script

Hackers compromised the domain DNS records of DebugBear, a third-party real user monitoring service, and replaced a legitimate script with a malicious one loaded by Polymarket. The hijacked script exploited authenticated trading sessions to steal approximately $2.64 million worth of POL tokens and positions from 726 affected wallets by reusing existing API keys and transaction signers. The attack occurred on October 29, 2026, and was active for about an hour before detection and mitigation. Polymarket responded by pausing trading, removing the malicious script, resetting sessions, and refunding affected users a total of $3.9 million.

AI-extracted · verify before operational use