{
  "id": "polymarket-debugbear",
  "url": "https://ohshit.app/incidents/polymarket-debugbear/",
  "title": "Polymarket confirms third-party breach; researchers find wallet-draining DebugBear script",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-10-29",
  "date_is_approximate": false,
  "updated": "2026-11-07",
  "tags": [
    "Polymarket",
    "DebugBear",
    "supply-chain",
    "crypto"
  ],
  "ecosystems": [
    "web"
  ],
  "summary": "Polymarket's postmortem confirms session abuse through a compromised monitoring script. It reports $2.7m in drained funds plus $1.2m for pause-related losses, with 95% of affected wallets refunded as of October 30. Trading resumed and active sessions were reset; total affected users remain undisclosed.",
  "splash": "Logged-in Polymarket.com users exposed to the malicious script; DebugBear RUM customers should remove its embed",
  "wipe": "Close exposed tabs, review account activity through a clean session, and remove DebugBear RUM embeds from your sites",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Close exposed tabs and inspect account activity",
      "hint": "Reject unexpected signatures. From a clean session, check orders, position movements and wallet transfers; preserve timestamps and transaction hashes for official support. Review sessions, API credentials and permissions with support. Disconnecting a wallet does not revoke on-chain approvals or reverse transfers. Never give recovery agents a seed phrase."
    },
    {
      "title": "Remove DebugBear RUM from your websites",
      "hint": "DebugBear asks RUM customers to remove the embed code. Check templates, tag managers and generated pages. This warning applies beyond Polymarket; it does not establish that every DebugBear customer was attacked."
    },
    {
      "title": "Hunt for the captured payload",
      "hint": "Check retained scripts and request logs for cdn.debugbear[.]com/C7xcKKrjUnXK.js; SHA-256 0755e767504d8103f6c27b9e765a1026507a17c04513242adb503df7777879e5; recipient 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18; tracking ID 4c6b64a0-a7ef-4c0f-9c70-3a4e6f89065c; data.debugbear[.]com/metrics/submit, /metrics/update and /metrics/handle; and configuration path /metrics/init. Preserve evidence without executing the file. A match alone is not proof of compromise: the hosts serve legitimate monitoring traffic, and configuration can change the recipient."
    },
    {
      "title": "Verify automatic compensation through official channels",
      "hint": "Polymarket says eligible wallets need no claim or ticket; its October 30 postmortem links an official review form for missing or disputed payments. Reach it from the official incident page, not unsolicited recovery messages. The reported 95% is a dated wallet figure, not a current completion guarantee."
    },
    {
      "title": "Compare the dated Bitquery tracing ledger",
      "hint": "Bitquery’s dated ledger has 16 role entries (15 distinct values): Polygon recipient 0x3f99139f1c5854bb628c2e576aaf638e99dffc18; largest-drain transaction 0xc6fcf3a65c85eb322fe41c193f74bb37845e19be29364b126d3ea7a149f78dcc; gfg44433 account 0x5a2764fbbe5d139ef0ed988ec5f95320ce730c0b; Polygon split wallet (15.3m POL) 0xe4c4c39c1733e1c7c06b79f97ed442b68df41ec6; Polygon split wallet (4.3m POL) 0x5392587814ce8c6af6789764f88e5e9ab0b9962c; bridge wallet on Polygon and Ethereum (two ledger entries) 0xc91ee0574a14446de200923729c349b9cae19b60; Polygon bridge wallet (3.28m POL) 0x3f7019221a925537dc20767c38e80a7127fb1ffa; Ethereum collection wallet 0xe5e76a4d73f3bfb5cc9a8f53d4f8459fcac495f6; Ethereum pass-through wallet 0x74e940e4eb470a9d8b78c5eb8919938041219897; Polygon bridge-entry transaction 0x6ff9322601c17bd3f82933c5a9399a615d7c8687f786646225531a9369af7738; Polygon bridge-claim transaction 0x744fdeed0629d9704f42817de0cbbe04626a0a8860892fa411daa440a054825f; Ethereum swap wallet 0x9ab3c17b1a37886f1d702945fcf8016e3e549b18; deBridge-entry transaction 0xa7727418d0c2dce55461840c41ef017d2646feb72f18e5bb74ad4af20b884351; Polymarket wallet factory 0x00000000000fb5c9adea0298d729a0cb3823cc07; Relay router on Polygon 0xb92fe925dc43a0ecde6c8b1a2709c170ec4fff4f. Compare historical transactions, not just current balances. The factory and router are legitimate infrastructure, not attacker wallets; account labels are not verified people. A match alone does not prove compromise or loss. Figures and balances stop at October29 19:49 UTC; use the complete linked report for context."
    },
    {
      "title": "Track the governance decision without treating a proposal as recovery",
      "hint": "Read the original Polygon forum proposal, subsequent governance decision and official client release. Separate transaction blocking, proposed recovery, actual returned funds and customer compensation. It lists this case’s addresses 0xe4C4C39C1733e1C7c06B79f97ED442B68Df41EC6, 0x5392587814Ce8c6af6789764f88e5e9AB0b9962C, 0xc91ee0574a14446DE200923729c349B9CAE19b60, 0x3f7019221a925537dC20767C38e80A7127fb1Ffa, with a historical reference total of 23,862,736.07 POL; roles are the proposal’s attribution and a match alone does not prove a new compromise. Only native POL would move; other tokens and Class B addresses are excluded. Recovery addresses must prove control. A PPGC discussion is planned for November 5 at 14:30 UTC; activation requires governance approval, Amoy rehearsal and a final release, with no client version or activation block decided yet. Do not transfer to unsolicited recovery addresses, connect a wallet or sign a claim. Existing reimbursement and security steps still apply."
    }
  ],
  "sources": [
    {
      "name": "Polymarket official status history",
      "url": "https://status.polymarket.com/history/1",
      "says": "Records the October 29 pause, provider compromise, reimbursement commitment and resolution, with explicit UTC timestamps.",
      "primary": true
    },
    {
      "name": "Hudson Rock research",
      "url": "https://www.infostealers.com/article/polymarket-breach-alert-wallet-draining-code-found-in-a-third-party-script/",
      "says": "Directly read static analysis of session reuse and asset-transfer logic, with captured-sample indicators and explicit limits on financial and exposure-window evidence.",
      "primary": true
    },
    {
      "name": "DebugBear security notice",
      "url": "https://x.com/DebugBear/status/2115866496643535293",
      "says": "Original vendor notice; read through the official X embed below.",
      "primary": false
    },
    {
      "name": "Official X embed of DebugBear's notice",
      "url": "https://publish.twitter.com/oembed?url=https%3A%2F%2Fx.com%2FDebugBear%2Fstatus%2F2115866496643535293&omit_script=true",
      "says": "DebugBear confirms an ongoing security incident and tells RUM customers to remove its embed code.",
      "primary": true
    },
    {
      "name": "Polymarket October 30 postmortem",
      "url": "https://status.polymarket.com/cmvvek1i90eme14ruga1z6tuj",
      "primary": true
    },
    {
      "name": "DebugBear October 30 investigation update",
      "url": "https://www.linkedin.com/posts/debugbear_were-continuing-to-investigate-the-security-activity-7522072665495588865-NsiJ",
      "says": "Reports registrar-mediated DNS compromise, interrupted inbound email and preliminary scope; public post metadata dates publication to October 30 at 23:11 UTC.",
      "primary": true
    },
    {
      "name": "Bitquery original October29 on-chain investigation",
      "url": "https://www.bitquery.io/investigations/polymarket-hack",
      "says": "Traces one recipient route through October29 19:49 UTC; supplies account/withdrawal counts and a 16-entry ledger. This predates the operator postmortem and refunds.",
      "primary": true
    },
    {
      "name": "Original Polygon forum native-POL recovery proposal",
      "url": "https://forum.polygon.technology/t/pip-proposal-recovery-of-funds-held-in-blocked-addresses-following-the-polymarket-and-binance-incidents/22497",
      "says": "Author proposes moving about 70.49M native POL from five listed addresses; separates incident shares, approval/rehearsal conditions and undecided activation parameters. Not evidence of an executed fork or repayment.",
      "primary": true
    },
    {
      "name": "Security Alliance incident-response roundup",
      "url": "https://radar.securityalliance.org/seal-weekly-stats-28-oct-3-nov-2026/",
      "says": "Reports two victim contacts and one completed asset freeze. Gives no amount or repayment result.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "Polymarket confirms a provider compromise and reimbursement for affected users.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Oct 29, 17:38 UTC",
      "title": "Polymarket reports unauthorized wallet activity"
    },
    {
      "date": "Oct 29, 18:05 UTC",
      "title": "Polymarket pauses new trades and relayer actions"
    },
    {
      "date": "Oct 29, 18:37 UTC",
      "title": "Polymarket confirms the provider compromise and promises reimbursement"
    },
    {
      "date": "Oct 29, 19:05 UTC",
      "title": "Official status history marks the incident resolved"
    },
    {
      "date": "Oct 29, 19:49 UTC",
      "title": "Bitquery snapshot traces 737 drained accounts",
      "body": "Its route-specific analysis counts 985 withdrawals and about $2.73m; these are researcher estimates, not unique-person or final incident totals."
    },
    {
      "date": "Oct 30, 20:07 UTC",
      "title": "Postmortem details containment and compensation",
      "body": "Polymarket reports cache clearance, active-session resets and $3.9m in total compensation."
    },
    {
      "date": "Oct 30, 23:11 UTC",
      "title": "DebugBear reports DNS changes through its registrar",
      "body": "Its preliminary investigation points to a specific customer website; it reports no evidence of an internal-system compromise so far."
    },
    {
      "date": "Nov 4, 2026",
      "title": "SEAL reports one asset freeze from two victim reports",
      "body": "The response roundup gives no frozen amount or evidence of funds being returned."
    },
    {
      "date": "Nov 4, 2026",
      "title": "Polygon forum proposes a native-POL recovery fork; approval is pending",
      "body": "The proposal attributes 23,862,736.07 POL to this incident, within about 70.49M POL across two separate cases. It is a governance proposal with no decided client release or activation block, not completed recovery or additional user compensation."
    }
  ],
  "body_markdown": "Polymarket's international platform confirmed a compromised provider on October 29 and committed to compensating affected users. Its status page now records the outage as resolved. L4 reflects a real compromise, rather than a theoretical vulnerability.\n\nHudson Rock attributes the malicious script to a DebugBear delivery URL. The sample reuses the logged-in application's trading client and signer to attempt position transfers or sales and subsequent asset transfers. This does not prove every signing request silently succeeds, private keys were exported, or smart contracts were compromised. Removing the script does not establish that every already-open session is safe.\n\nThe platform's notice does not name its provider; DebugBear separately acknowledges an incident. The precise exposure window, how access to the registrar was obtained and total affected population remain unknown. The later operator figures below supersede the absence of a vendor loss estimate; wallet balances and individual claims are not aggregate losses. This is a separate October event; June incident figures must not be reused for it.\n\n**October 30 postmortem:** Polymarket reports removing the script, clearing caches and resetting active sessions. It assigns $2.7m to drained funds and $1.2m to pause-related losses: $3.9m in compensation, not $3.9m stolen. Its 95% refund figure includes drained-wallet and goodwill refunds at that time. These are operator figures, not an independent audit. It also describes stronger script integrity controls and continued investigation.\n\n**DebugBear’s October 30 update:** The provider says its DNS records were altered through its domain registrar. Its early findings point to one customer website, with no evidence so far of intrusion into its internal systems; investigation continues. This does not establish that other customers were unaffected or that the monitoring script is safe to restore. DebugBear also reported that inbound email to its domain was unavailable at the time; follow its public updates rather than assuming an emailed support request was received.\n\n**Dated on-chain scope:** Bitquery counts 737 drained accounts and 985 withdrawals on its main route, plus outcome-share transfers from 33 accounts, through October 29 at 19:49 UTC. These are research-defined accounts, not unique people; do not add the 33 to 737 without resolving overlap. Its approximately $2.73m is a route-specific estimate using dated conversion prices, not an extra loss to add to Polymarket’s reported $2.7m stolen or $3.9m compensation. The snapshot does not measure later refunds or establish today’s exposed population.\n\n**November 4 Polygon governance proposal:** The original forum proposal says five transaction-blocked addresses hold about 70.49M native POL associated with two separate incidents: four Polymarket addresses have a reference total of 23,862,736.07 POL and one Binance address 46,626,593.27 POL. It requests a one-time coordinated fork moving the specified balances to verified recovery addresses without changing supply; other tokens and Class B addresses are outside the transfer. Governance approval, balance reconciliation, proof of recovery-address control and an Amoy rehearsal are conditions. The client release, fork name and mainnet activation block are undecided. November 5 at 14:30 UTC is the planned discussion, not an activation promise. Address ownership and blocking are the author’s account, not an independent chain investigation here. This does not establish an approved fork, returned assets or additional customer reimbursement. Do not add the two incident shares to this event’s loss, or double-count them with frozen funds, replacement funding or compensation.\n\nSEAL’s November 4 roundup reports that two affected people contacted its responders and that it completed one asset freeze. The roundup gives no amount and does not connect the freeze to a specific Polygon address. Count the freeze separately from user refunds and the proposed native-POL recovery."
}