DebugBear supply chain attack drains $2.7 million from Polymarket traders

Polymarket halted trading on its international platform on October 29 after unauthorized withdrawals and pledged to reimburse affected users. Malicious JavaScript served via UK-based DebugBear's real user monitoring snippet sold traders' positions or sent tokens to an attacker-controlled address. Loss estimates range from $2.19 million to $2.71 million.

• Polymarket paused trading for about an hour and promised to make affected traders whole
• GoPlus put losses at $2.71 million; Hudson Rock saw $2.19 million at the script's address
• The attack path ran through 710 deposit wallets and 731 addresses
• DebugBear confirmed the incident and urged customers to remove its snippet