What Happened in the DebugBear Polymarket Script Compromise?
As of November 2026: a wallet-draining script was served from DebugBear's CDN to visitors of Polymarket, which used DebugBear's real user monitoring tag. According to published research, the code checked whether the visitor was logged in, then used the session to sell prediction-market positions or move tokens to an attacker's wallet. DebugBear confirmed a security incident and asked RUM customers to remove the embed code. According to published reports, Polymarket paused trading, attributed the incident to a compromised third-party provider, and will reimburse affected traders. Published estimates trace $2.5 million to $2.7 million to the attacker's wallet. This video covers what was reported, what has not yet been said, why it is a client-side supply-chain attack, why a CSP alone would not have stopped it, and five things to do this week. It reflects public information as of November 2026 and may be out of date.
Full answer: DebugBear Polymarket Hack: A Client-Side Supply Chain Attack
Transcript
In 2026, DebugBear's performance monitoring script served a wallet drainer to Polymarket visitors, using their logged-in sessions to sell positions and move tokens. It's a client-side supply-chain attack: a trusted vendor's script changed what it did. Polymarket paused trading after users reported their accounts were being emptied. Within hours, the cause had a name: DebugBear, a website performance monitoring service. That evening, DebugBear confirmed a security incident and asked customers of its RUM product to remove the embed code from their websites. According to published research, the script's contents were replaced with code that checked whether the visitor was logged in, then used that session to sell positions or move tokens to an attacker's wallet. All in the visitor's browser. Published estimates trace $2.5 million to $2.7 million to the attacker's wallet. According to published reports, Polymarket will reimburse affected traders. DebugBear has since said the attackers took over its DNS through its domain registrar. It hasn't said when it started, or whether other customers got the code. Why is this client-side? The script came from the same trusted domain, ran in visitors' browsers, and acted as the logged-in user. Servers and allowlists saw nothing wrong. It's the Magecart pattern, aimed at crypto instead of cards. Would a CSP have stopped it? Not on its own: the code came from DebugBear's own CDN, which the site would have allowed. SRI would have refused the changed file, but vendor tags like this one are rarely pinned. Three signals would have stood out. The script's contents changed, even at the same URL. It started doing things a speed monitor has no reason to do. And it could be blocked without a deploy. This week: if you use DebugBear RUM, remove it until DebugBear publishes a full account. List every third-party script. Ask who owns each one. Watch what runs, not just where it loads from. And make sure you can block without a deploy. Script Monitoring records every script in every real session: its payload, what it does, and when either changes. It's free for 1,000 page views a month, and Pro starts at $99 a month, with a 14-day trial. Start for free at scriptmonitoring.com.