Polymarket confirms third-party breach; researchers find wallet-draining DebugBear script

Polymarket’s international platform confirmed a compromised provider on October 29 and committed to compensating affected users. Its status page now records the outage as resolved. L4 reflects a real compromise, rather than a theoretical vulnerability.

Hudson Rock attributes the malicious script to a DebugBear delivery URL. The sample reuses the logged-in application’s trading client and signer to attempt position transfers or sales and subsequent asset transfers. This does not prove every signing request silently succeeds, private keys were exported, or smart contracts were compromised. Removing the script does not establish that every already-open session is safe.

The platform’s notice does not name its provider; DebugBear separately acknowledges an incident. The precise exposure window, how access to the registrar was obtained and total affected population remain unknown. The later operator figures below supersede the absence of a vendor loss estimate; wallet balances and individual claims are not aggregate losses. This is a separate October event; June incident figures must not be reused for it.

October 30 postmortem: Polymarket reports removing the script, clearing caches and resetting active sessions. It assigns $2.7m to drained funds and $1.2m to pause-related losses: $3.9m in compensation, not $3.9m stolen. Its 95% refund figure includes drained-wallet and goodwill refunds at that time. These are operator figures, not an independent audit. It also describes stronger script integrity controls and continued investigation.

DebugBear’s October 30 update: The provider says its DNS records were altered through its domain registrar. Its early findings point to one customer website, with no evidence so far of intrusion into its internal systems; investigation continues. This does not establish that other customers were unaffected or that the monitoring script is safe to restore. DebugBear also reported that inbound email to its domain was unavailable at the time; follow its public updates rather than assuming an emailed support request was received.

Dated on-chain scope: Bitquery counts 737 drained accounts and 985 withdrawals on its main route, plus outcome-share transfers from 33 accounts, through October 29 at 19:49 UTC. These are research-defined accounts, not unique people; do not add the 33 to 737 without resolving overlap. Its approximately $2.73m is a route-specific estimate using dated conversion prices, not an extra loss to add to Polymarket’s reported $2.7m stolen or $3.9m compensation. The snapshot does not measure later refunds or establish today’s exposed population.

November 4 Polygon governance proposal: The original forum proposal says five transaction-blocked addresses hold about 70.49M native POL associated with two separate incidents: four Polymarket addresses have a reference total of 23,862,736.07 POL and one Binance address 46,626,593.27 POL. It requests a one-time coordinated fork moving the specified balances to verified recovery addresses without changing supply; other tokens and Class B addresses are outside the transfer. Governance approval, balance reconciliation, proof of recovery-address control and an Amoy rehearsal are conditions. The client release, fork name and mainnet activation block are undecided. November 5 at 14:30 UTC is the planned discussion, not an activation promise. Address ownership and blocking are the author’s account, not an independent chain investigation here. This does not establish an approved fork, returned assets or additional customer reimbursement. Do not add the two incident shares to this event’s loss, or double-count them with frozen funds, replacement funding or compensation.

SEAL’s November 4 roundup reports that two affected people contacted its responders and that it completed one asset freeze. The roundup gives no amount and does not connect the freeze to a specific Polygon address. Count the freeze separately from user refunds and the proposed native-POL recovery.