What a Hijacked DebugBear Script Checked Before Polymarket Paused Trading on Oct. 29

Polymarket paused trading on its international platform on Thursday, Oct. 29, 2026, after a security incident at a third-party provider. Attackers distributed malicious JavaScript through infrastructure tied to the provider, and the code ran in the browsers of visitors, checking whether they were logged in to the exchange.

Polymarket said it had fixed the problem and resumed trading the same afternoon. A Reuters report, carried by Digit, identified the provider as DebugBear, a website performance-monitoring company. DebugBear said it was dealing with an ongoing security incident.

How the Malicious Script Acted on Logged-In Accounts

BleepingComputer’s analysis describes JavaScript served from infrastructure tied to DebugBear. The script checked whether a visitor was logged in to Polymarket, then tried to use that existing trading session to make unauthorized transactions. Hudson Rock identified the script, served from cdn.debugbear.com, as designed to steal crypto and prediction-market holdings from Polymarket users.

The script then checked each user’s crypto balances and prediction-market positions to value their holdings. For some users, the script tried to sell their prediction-market positions automatically. For others, it tried to move their prediction-market tokens to a wallet controlled by the attacker.

It also tried to convert crypto holdings into assets it could move, using Polymarket’s own transaction functions. The report says the script communicated with data.debugbear.com to receive instructions and send data about targeted accounts, wallet addresses, balances and transaction results.

Polymarket’s timeline, as reported by BleepingComputer, shows the exchange moved to cancel-only mode at 2:05 p.m. ET and the issue was fixed by 2:37 p.m. ET. BleepingComputer reports that a suspected attacker wallet made numerous transactions involving Polymarket’s prediction-market token between 1:50 p.m. and 1:56 p.m. ET, shortly before the suspension. Trading resumed about an hour after the suspension, and the incident was marked resolved at 3:05 p.m. ET.

Timeline on Oct. 29
According to BleepingComputer, Polymarket’s timeline shows cancel-only mode from 2:05 p.m. ET and a fix by 2:37 p.m. ET on Oct. 29, 2026.

Loss Figures Are Early and Incomplete

BleepingComputer reports that about $2.5 million was traced to a suspected attacker wallet. That wallet sent roughly 28.6 million POL, about $2.57 million, to three other wallets. Hudson Rock, which investigated, reported that the wallet held about $2.19 million in cryptocurrency at the time of its investigation.

The three figures describe different things at different points: funds traced to the wallet, funds the wallet sent onward, and funds it held when Hudson Rock looked. They come from published analysis by BleepingComputer and Hudson Rock, not from a disclosure by Polymarket.

Polymarket has not disclosed how many users were affected or how much was stolen.

What Polymarket and DebugBear Have Said, and What Remains Open

In a statement, Polymarket said a security incident had compromised a third-party provider. It halted trading on its international platform out of an abundance of caution, said it had referred the incident to UK law enforcement, and said affected users would be made whole. Digit reports that Polymarket said it would fully reimburse affected traders.

DebugBear said on X that it was affected by an ongoing security incident. It asked customers using its real user monitoring product to remove the embed code from their websites, according to Digit and BleepingComputer. BleepingComputer reported that DebugBear’s website was inaccessible at the time of writing, displaying a Cloudflare error, and says it is unclear whether that outage is part of containment or a separate consequence of the incident.

Hudson Rock also found a Polymarket production build timestamped 1:59 p.m. ET on Oct. 29, with a commit message about removing the DebugBear real user monitoring script. BleepingComputer reports that the build indicates Polymarket had removed the DebugBear integration shortly before the public announcement.

BleepingComputer raises questions about how much access the attackers had to DebugBear’s systems, since that infrastructure served as the distribution point and the channel for instructions and stolen data.

Polymarket has not disclosed how the reimbursement process will work. DebugBear has described its incident as ongoing.

The Polymarket case shows that a third-party snippet can act inside a signed-in session.

Questions for Fashion and Beauty Vendors

The Polymarket case shows that a third-party snippet can act inside a signed-in session.

Questions to put to a monitoring vendor include which files a site loads and whether they can be pinned to a fixed version, whether those files support integrity fingerprints, which domains the snippet contacts, whether it can be kept off checkout and account pages, how the vendor notifies customers of an incident, and how quickly it can disable its own code.

In the Polymarket case, the script used the platform’s trading functionality through users’ existing sessions. On a fashion or beauty site, the pages where a shopper is signed in, such as account and checkout pages, are where these questions matter most.