Polymarket DebugBear Supply-Chain Attack: When RUM Scripts Become Wallet Drainers

Polymarket’s October 29, 2026 outage was not a blockchain consensus failure or a compromised smart contract at the protocol layer—it was a supply-chain attack on front-end JavaScript. Attackers replaced a DebugBear real-user monitoring (RUM) script Polymarket loaded with a wallet drainer that operated inside authenticated sessions for roughly an hour. Researchers traced about $2.7 million in unauthorized transfers across 700+ wallets; Polymarket pledged roughly $3.9 million in refunds including pause-related losses and referred the incident to U.K. authorities because DebugBear is based there.

For Web3 operators, the lesson is brutal: your CSP and relayer are part of the attack surface.

Timeline: 52 minutes of in-session draining

Independent analysis documented the drainer active between about 16:54 UTC and 17:59 UTC on October 29, after the legitimate DebugBear origin failed and a malicious script took its place. Logged-in users executing trades unknowingly ran attacker code with access to Polymarket’s own client libraries.

The malicious script:

• Borrowed Polymarket’s in-page trading client
• Signed transfers with the user’s existing signer
• Submitted transactions through Polymarket’s relayer—so every destination except DebugBear sat on Polymarket’s allowlisted Content Security Policy

In 52 minutes, a recipient wallet absorbed 28.6 million POL, stablecoins, and position tokens from 33 deposit wallets, then forwarded assets through a chain of addresses within roughly 90 minutes.

Why this matters beyond prediction markets

Prediction markets concentrate high-value wallets and fast decision-making—perfect for social engineering. But the exploit pattern applies to any crypto front end loading third-party analytics, A/B testing, chat widgets, or ad tags.

Blockaid and other security firms had already warned that EIP-7702 delegation features complicate wallet security; Polymarket’s incident shows you do not need novel Ethereum mechanics if you can hijack session-bound signing in the browser.

DebugBear and third-party script governance

DebugBear publicly acknowledged a security incident. Polymarket removed the script and resumed trading around 3 p.m. ET Thursday, according to CNBC. The fix on Polymarket’s side does not restore trust in default third-party inclusion.

Crypto products should treat RUM vendors like mini supply-chain partners:

Relayer trust assumptions

Using an in-house relayer improves UX but couples authorization logic to front-end integrity. If the page is poisoned, the relayer becomes a high-speed exfiltration pipe—exactly what happened here.

Mitigations include hardware-backed signing prompts outside the DOM, transaction simulation previews with human-readable summaries, and velocity limits on relayer submissions per session.

User remediation and disclosure quality

Polymarket’s refund tiering—automatic restoration under $10,000, release forms above that—will be studied in law schools. Transparency helps, but forms create friction victims may not complete under stress.

Industry groups should push standardized breach disclosures for crypto front ends, akin to PCI incident templates: scope, root cause, indemnification timeline, on-chain addresses involved.

Linkage to a brutal week in crypto security

The Polymarket drainer landed in the same news cycle as Binance’s $6.3–6.4 billion hot-wallet theft attributed to North Korea’s TraderTraitor group—different mechanics, same headline: centralized interfaces remain the soft target.

Cubed readers building DeFi or exchange UX must assume attackers combine:

• Traditional web supply-chain compromise
• On-chain laundering automation
• Social panic during outages

Builder checklist after Polymarket

1. Inventory every <script src= on production, including tag managers.
2. Move signing out of pages that load analytics.
3. Run red-team exercises that only tamper with CDN-hosted RUM files.
4. Publish runbooks users can follow when trading pauses—signed PGP updates, official mirrors, on-chain multisig announcements.

Polymarket survived operationally by refunding and reopening markets. The ecosystem survives only if third-party JavaScript stops being an afterthought in Web3 security models.

Broader DebugBear incident lessons for SaaS

Any performance monitoring vendor with script injection becomes a high-value target. Security teams should classify RUM providers as Tier 1 supply-chain vendors with annual pen tests and mandatory SRI hashes published in customer docs.

On-chain analytics after the drainer

Researchers tracked POL consolidation across downstream wallets within 90 minutes—speed that implies automated laundering playbooks. Exchanges and bridges should flag rapid fan-out patterns even when individual transfers look small.

User education gaps

Many victims did not realize signing occurred until balances dropped. Wallets and dApps should adopt transaction preview modals listing asset outflows in plain language, independent of dApp UI skins.

Regulatory trajectory

U.K. involvement because of DebugBear jurisdiction may produce cross-border cooperation templates useful for future front-end hacks. Compliance officers should archive Polymarket postmortems when drafting incident response policies.

Builder red-team exercise

Simulate compromised CDN scripts monthly; measure time-to-detect and time-to-pause trading. If detection exceeds single-digit minutes, architecture needs work.

Additional context for practitioners

Teams shipping in this environment should document assumptions, rollback paths, and owner on-call rotations before scaling pilots. Weekly reviews that compare leading indicators—not only lagging revenue—help catch policy or security drift early. Cross-functional attendance (legal, security, product, finance) prevents siloed decisions that look efficient locally but create enterprise risk globally.

Vendor management matters: require subprocessor lists, incident SLAs, and exit plans when third-party scripts or APIs sit on critical paths. Tabletop exercises should include partial outages, bad deploys, and media crises happening simultaneously—because in October and November 2026, they did.

Training programs should upskill staff on reading postmortems, not only marketing keynotes. The difference between teams that survive volatile news cycles and teams that do not is often operational literacy: knowing which metrics are real, which claims are aspirational, and which controls actually enforce behavior under stress.

Finally, publish internal runbooks with version numbers. When regulators or partners ask what you knew and when, dated artifacts beat memory. This discipline is unglamorous and reliably differentiates mature organizations from those improvising in public every quarter.

Additional context for practitioners

Teams shipping in this environment should document assumptions, rollback paths, and owner on-call rotations before scaling pilots. Weekly reviews that compare leading indicators—not only lagging revenue—help catch policy or security drift early. Cross-functional attendance (legal, security, product, finance) prevents siloed decisions that look efficient locally but create enterprise risk globally.

Vendor management matters: require subprocessor lists, incident SLAs, and exit plans when third-party scripts or APIs sit on critical paths. Tabletop exercises should include partial outages, bad deploys, and media crises happening simultaneously—because in October and November 2026, they did.

Training programs should upskill staff on reading postmortems, not only marketing keynotes. The difference between teams that survive volatile news cycles and teams that do not is often operational literacy: knowing which metrics are real, which claims are aspirational, and which controls actually enforce behavior under stress.

Finally, publish internal runbooks with version numbers. When regulators or partners ask what you knew and when, dated artifacts beat memory. This discipline is unglamorous and reliably differentiates mature organizations from those improvising in public every quarter.