Hijacked page-speed script drained about $2.7 million from Polymarket traders
Affected traders are being refunded $3.9 million, and the case shows how one outside script can reach users who are signed in and trading.
Prediction market Polymarket lost roughly $2.7 million from signed-in traders after malicious code replaced a page-speed script it loaded from DebugBear on October 29. The injected code used the open trading session to sell positions or move funds, with about $2.64 million in POL reaching the attacker's wallet within an hour. Polymarket has halted and then resumed activity, removed the script, reset sessions, and is refunding $3.9 million, including $1.19 million to about 5,500 wallets affected by the trading pause or sold positions. DebugBear says its DNS records were compromised through its domain registrar and that its early findings point to a single customer's site, while it reports no breach of its own systems. For developers, the case highlights the risk of third-party scripts on pages where users sign transactions, and the value of Subresource Integrity and stricter content security policies.
Why it matters
The attack did not break into Polymarket's own systems; it used a script the site trusted and loaded from a third party, so users who sign transactions were exposed through a dependency they did not control. For traders, the lesson is that a page can be safe on its own and still be unsafe once an outside script is swapped out. Polymarket's response, removing the script and restoring third-party code only with added checks, shows the company treating that outside dependency as the point of failure. The same weakness reaches beyond one exchange: DebugBear's compromise came through its domain registrar, which means the chain of trust behind a script can fail well before the code itself does.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.