A technical analysis by Hudson Rock has detailed how a malicious JavaScript file served from DebugBear infrastructure attempted to use active Polymarket trading sessions to sell positions or transfer tokens. The findings add technical detail to the October 29 incident, when Polymarket paused trading on its international platform after confirming that a third-party provider had been compromised. The company later restored trading and promised to reimburse affected users, following the Polymarket security incident.
Hudson Rock said it retrieved a 15,187-byte script from a DebugBear content-delivery address and reviewed the file without executing it. The code searched the browser application for the trading client and signer already used by a logged-in customer, inspected account context and portfolio positions, and attempted to sell holdings or transfer position tokens to a configured recipient. The researchers said the behavior depended on the account type and available signing authority, and cautioned that the code’s intended actions do not prove every transfer succeeded. They did not find a routine that sent a password, seed phrase, private key or credential map to the script’s reporting endpoint; the code instead attempted to reuse authority available inside the active trading session.
The researchers also found a change message in Polymarket’s production build metadata reading “remove debugbear rum script.” The build carried an October 29 timestamp of 17:59:20 UTC. Hudson Rock said this supports the removal of the integration in the observed build, but a build timestamp does not establish the exact deployment time or prove that every existing browser session was safe.
Hudson Rock reviewed a screenshot showing about $2.19 million in holdings at the fallback recipient address embedded in the script. It said the balance was not a verified total of stolen funds and did not establish how many users were affected. BleepingComputer’s blockchain review traced roughly 28.6 million POL, worth about $2.57 million at the time, from that address to three additional wallets. Neither the address balance nor those transfers establish the total amount stolen.
Reuters reported that a source familiar with the incident identified the compromised provider as DebugBear, a website performance monitoring service. DebugBear separately acknowledged an ongoing security incident and told customers using its Real User Monitoring product to remove the embedded code from their websites. Polymarket’s official status notice confirmed a third-party provider compromise but did not name the company.
Polymarket said it had fixed the issue, referred the incident to law enforcement and would fully reimburse affected traders. Its status page marked the incident resolved on October 29, after the international exchange had been placed in cancel-only mode and trading was paused for about an hour. In an October 30 postmortem, Polymarket said it would return $3.9 million in total: $2.7 million to affected traders and another $1.2 million to cover losses linked to the trading pause. The company said it identified eligible wallets from on-chain and trading data and would reimburse them automatically. The $3.9 million figure includes pause-related compensation and should not be treated as the amount stolen in the attack.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
