EN PT-BR
← Voltar ao feed
critical cryptocurrency financial services technology financial

Polymarket users hit by wallet-draining JavaScript injected via compromised DebugBear RUM script; trading halted, $2.2M–$2.7M estimated lost

4 fonte(s) · 4 atualização(ões) · publicado 29/10/2026 15:33 · coletado há 2 dias

Matéria consolidada. Reúne 5 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 4 fontes trouxeram em 31/10/2026 00:07; os links antigos trazem para cá.

Fontes: securityweek.com ↗ gbhackers.com ↗ bleepingcomputer.com ↗ infostealers.com ↗

On October 29, 2026, a supply-chain attack on the UK-based web performance monitoring vendor DebugBear caused a malicious version of its Real User Monitoring (RUM) script to be served to Polymarket users on its international platform (securityweek.com). The script hijacked authenticated trading sessions to sell positions and move assets to an attacker wallet, 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18. Polymarket put the exchange in cancel-only mode at 2:05 p.m. ET and suspended relayer actions (securityweek.com). It declared the issue fixed at 2:37 p.m. and fully restored trading by 3:05 p.m. It pledged to reimburse affected traders and referred the matter to law enforcement (bleepingcomputer.com, gbhackers.com). DebugBear confirmed it was "impacted by an ongoing security incident", engaged specialist incident responders and told customers to remove its RUM embed code (bleepingcomputer.com, securityweek.com). Hudson Rock identified and analyzed the payload, a 15,187-byte file served from cdn.debugbear[.]com/C7xcKKrjUnXK.js (infostealers.com). Loss estimates now range from about $2.19 million to $2.71 million. Polymarket's US platform was reportedly unaffected, and there is no indication other DebugBear customers were targeted (securityweek.com). The number of victims, confirmed total losses, attacker identity and initial compromise mechanism remain unresolved.

Detalhes técnicos

  • The payload was served from DebugBear's CDN. The CDN Last-Modified header showed October 27, 2026 12:50:43 GMT, and two retrievals minutes apart returned byte-identical content (infostealers.com). A WhoGetsMyData scan dated October 29 recorded Polymarket loading the URL and allowing the host in its CSP (infostealers.com).
  • The script read the local-storage keys polymarket.auth.params, polymarket.auth.proxyWallet and poly_clob_api_key_map, and distinguished eoa from magic account types (infostealers.com). No routine was found exfiltrating credential maps, passwords, seed phrases or private keys. The core technique is abusing authority already present in the authenticated session (infostealers.com, securityweek.com).
  • It walked React component properties and hook state to find objects exposing postOrder, createOrder or createMarketOrder, plus the associated signer. This is logic specific to Polymarket's trading workflow (infostealers.com).
  • It queried balances and positions and computed portfolio value. It applied thresholds (fallback total-value threshold 10, per-position threshold 10) and checked Polymarket's geoblock response, exiting if the user was blocked (infostealers.com).
  • Value was redirected in one of two ways. It either submitted SELL orders at increasingly aggressive prices and then transferred the proceeds, or built an ERC-1155 batch transfer of position tokens to the configured recipient (infostealers.com). Depending on the authentication method, it could also convert holdings into transferable assets using Polymarket's own transaction functionality (bleepingcomputer.com).
  • It built EIP-712 DepositWallet batch messages for Polygon, requested signatures through the existing signer and submitted signed batches to Polymarket's relayer, with conversion/swap routes and a direct token-transfer fallback (infostealers.com).
  • It beaconed wallet addresses, IP/country, OS, account type, portfolio values, position summaries and transfer results to data.debugbear[.]com via /metrics/submit, /metrics/update and /metrics/handle (infostealers.com). BleepingComputer notes that this C2/exfiltration channel suggests deep attacker access to DebugBear infrastructure (bleepingcomputer.com).
  • GoPlus on-chain analysis traced the main attack path through 710 deposit wallets and 731 addresses. The hard-coded fallback recipient address matches the suspected attacker wallet seen by Arkham (securityweek.com).
  • Attacker wallet activity against Polymarket's token contract was observed between 1:50 and 1:56 p.m. ET (bleepingcomputer.com).
  • Polymarket's production build metadata, retrieved at 18:13:43 UTC, contains the commit message chore(polymarket): remove debugbear rum script (#15337). Its build timestamp is 17:59:20 UTC, equivalent to 1:59 p.m. ET and just before public disclosure (infostealers.com, bleepingcomputer.com, securityweek.com).
  • How the script was tampered with, and how many users were hit, remain undetermined (securityweek.com). Users reported unauthorized withdrawals and zero balances, but these are individual claims rather than verified loss assessments (gbhackers.com).

Remediação

  • DebugBear customers: immediately remove the DebugBear RUM embed code from all sites, per DebugBear's advisory (bleepingcomputer.com, securityweek.com).
  • Site operators: review third-party script inclusions and apply Subresource Integrity and a strict CSP where possible. Monitor for unexpected build or script changes. Audit wallet activity for users who visited affected sites during the window (bleepingcomputer.com, securityweek.com).
  • Polymarket users: reject unexpected signing or approval prompts and close exposed tabs. Review recent orders, positions and on-chain transactions from a clean session, particularly those from October 29. Revoke unnecessary wallet permissions and watch for Polymarket's reimbursement guidance (infostealers.com, bleepingcomputer.com, gbhackers.com).
  • Reimbursement remains a commitment with no published deadline, eligibility criteria or claims process (gbhackers.com).
  • Context: Polymarket previously suffered a similar third-party frontend script injection in June, with around $3 million in losses (securityweek.com).

Relatos divergentes

  • Amount at risk: infostealers.com cites a PolygonScan screenshot showing roughly $2.19 million in holdings at the attacker address and stresses this is not a verified accounting of stolen funds. bleepingcomputer.com reports its own blockchain analysis showing about 28.6 million POL (~$2.57 million) moved from that wallet to three others. securityweek.com, the most recent source, reports estimates from roughly $2.19 million (Hudson Rock) to $2.71 million (GoPlus), with Arkham data showing a suspected attacker wallet holding about $2.65 million. None of these is a confirmed victim-loss total.
  • Cause and vendor confirmation: infostealers.com, the earlier source, said the initial compromise mechanism was unresolved and that no verified statement from Polymarket or DebugBear had been obtained. bleepingcomputer.com and securityweek.com, published later, report that DebugBear confirmed an ongoing security incident and that Polymarket pledged reimbursement and referred the matter to law enforcement. The compromise method itself is still unknown.
  • Provider identity and IOCs: gbhackers.com (October 30, early) said no provider identity, malicious wallet addresses or other IOCs had been published. This is outdated: securityweek.com, later, names DebugBear as the compromised provider and the other sources give the attacker wallet and payload details.

Linha do tempo

  1. securityweek.com ↗ · pub. 30/10/2026 06:41 · coletado 30/10 07:00

    Polymarket traders lose $2M+ after supply chain compromise of DebugBear RUM script

    ler a análise desta fonte

    Polymarket halted trading on its international platform (Polymarket.com) on October 29 after users reported unauthorized withdrawals, switching the exchange to cancel-only mode and suspending relayer actions. The company confirmed that a third-party provider was compromised, referred the matter to law enforcement, and pledged to make all affected traders whole. Researchers attributed the theft to malicious JavaScript served from DebugBear, a UK-based website performance monitoring firm, via its real user monitoring (RUM) snippet. Loss estimates range from roughly $2.19 million (Hudson Rock) to $2.71 million (GoPlus), with Arkham data showing a suspected attacker wallet holding about $2.65 million. Polymarket's US platform was reportedly unaffected, and there is no indication other DebugBear customers were targeted.

    Technical Details

    Hudson Rock obtained the malicious JavaScript from a DebugBear address used by Polymarket. The code enumerated a logged-in user's trading tools and portfolio and, depending on account type, either sold positions and moved the proceeds or sent position tokens directly to an attacker-controlled address. Hudson Rock noted the sample read credential-related material but found no routine exfiltrating credential maps, passwords, seed phrases or private keys — the core technique was abusing authority already present in the authenticated session. A Polymarket production build timestamped 17:59 UTC carried a change note removing the DebugBear script. GoPlus on-chain analysis traced the main attack path through 710 deposit wallets and 731 addresses. The hard-coded fallback recipient address matches the suspected attacker wallet seen by Arkham. How the script was tampered with, and how many users were hit, remain undetermined.

    Remediation

    DebugBear confirmed it was "impacted by an ongoing security incident", engaged specialist incident responders, and urged customers to remove its RUM snippet from their websites. Organizations embedding third-party JavaScript should audit externally hosted scripts, apply Subresource Integrity and CSP controls, and monitor for unexpected build or script changes. Polymarket previously suffered a similar third-party frontend script injection in June with around $3 million in losses.

  2. gbhackers.com ↗ · pub. 30/10/2026 03:06 · coletado 30/10 04:00

    Polymarket halts trading after third-party provider compromise; users report drained balances

    ler a análise desta fonte

    Polymarket temporarily suspended trading on its international platform, Polymarket.com, after disclosing that one of its third-party providers was compromised. Users reported unauthorized withdrawals and zero balances following the incident, though these remain individual claims rather than verified loss assessments. The company said it identified and fixed the issue, referred the matter to law enforcement, and committed to fully reimbursing affected traders. Trading was restored later the same day. No provider identity, exploit chain, loss total, or affected-user count has been published.

    Technical Details

    The disclosure confirms a supply-chain/third-party compromise but does not specify whether attackers reached authentication infrastructure, wallet services, application code, or another integration. No malicious wallet addresses, transaction hashes, or other IOCs were released, and no threat actor attribution is supported by the available evidence. The article notes that separate Web3 supply-chain investigations have documented malicious dependencies harvesting private keys and recovery phrases, but presents this as context only.

    Remediation

    Polymarket states the issue is fixed and trading resumed. Reimbursement remains a commitment with no published deadline, eligibility criteria, or claims process. Open questions include the provider's identity, scope of unauthorized access, and whether exposed credentials or wallet permissions still require remediation; users should review account activity and revoke unnecessary wallet permissions.

  3. bleepingcomputer.com ↗ · pub. 29/10/2026 18:47 · coletado 29/10 19:00

    Polymarket halts trading after DebugBear supply-chain compromise delivers crypto-draining JavaScript; ~$2.5M traced

    ler a análise desta fonte

    Polymarket temporarily suspended trading on October 29, 2026 after attackers compromised third-party web performance monitoring provider DebugBear and used its Real User Monitoring (RUM) JavaScript to distribute a cryptocurrency-draining script to Polymarket users. Hudson Rock researchers identified the malicious script at cdn.debugbear[.]com/C7xcKKrjUnXK.js and an attacker-controlled wallet 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18. BleepingComputer's blockchain analysis found roughly 28.6 million POL (~$2.57 million) moved from that wallet to three others. Polymarket placed the exchange in cancel-only mode at 2:05 p.m. ET, declared the issue fixed at 2:37 p.m., and fully restored trading by 3:05 p.m., pledging to reimburse affected traders and referring the matter to law enforcement. DebugBear confirmed an ongoing security incident and told customers to remove its RUM embed code.

    Technical Details

    The malicious JavaScript was served from DebugBear's CDN and also used data.debugbear.com as a command-and-control and exfiltration channel, suggesting deep attacker access to DebugBear infrastructure. The script checked whether a visitor was authenticated to Polymarket, then hijacked the existing trading session: it enumerated crypto balances and prediction-market positions, and depending on the authentication method either auto-sold positions, transferred prediction-market tokens directly to the attacker wallet, or converted holdings into transferable assets using Polymarket's own transaction functionality. It reported targeted accounts, wallet addresses, balances and transaction results back to the C2. Hudson Rock also found Polymarket build metadata with the commit message "chore(polymarket): remove debugbear rum script (#15337)" timestamped 1:59 p.m. ET, just before public disclosure. Attacker wallet activity against Polymarket's token contract was observed between 1:50 and 1:56 p.m. ET.

    Remediation

    Any organization using DebugBear RUM should immediately remove the embed code from their sites, per DebugBear's advisory. Review third-party script inclusions, apply Subresource Integrity and strict CSP where possible, and audit wallet activity for users who visited affected sites during the window. Polymarket users should review transactions and positions from October 29 and monitor for reimbursement guidance.

  4. infostealers.com ↗ · pub. 29/10/2026 15:33 · coletado 29/10 17:01 primeiro registro

    Polymarket supply-chain compromise: wallet-draining JavaScript served from DebugBear RUM script

    ler a análise desta fonte

    Hudson Rock independently retrieved and statically analyzed a 15,187-byte JavaScript payload served from cdn.debugbear[.]com/C7xcKKrjUnXK.js, a third-party RUM (real user monitoring) asset loaded by Polymarket. Instead of measuring page performance, the script reads Polymarket authentication data from local storage, traverses React internals to locate the live trading client and signer, inspects the user's portfolio, then attempts to sell positions and transfer assets to a hard-coded fallback recipient address 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18. A supplied PolygonScan screenshot shows roughly $2.19 million in holdings at that address, though this is not a verified accounting of stolen funds. Polymarket's production build metadata retrieved at 18:13:43 UTC on October 29, 2026 contains the commit message chore(polymarket): remove debugbear rum script (#15337) with a build timestamp of 17:59:20 UTC, corroborating removal. The number of victims, aggregate losses, attacker identity, and the initial compromise mechanism remain unresolved; no verified incident statement from Polymarket or DebugBear was obtained.

    Technical Details

    • Reads local-storage keys polymarket.auth.params, polymarket.auth.proxyWallet, and poly_clob_api_key_map; distinguishes eoa vs magic account types. No routine was found exfiltrating seed phrases or private keys — the design reuses authority already present in the authenticated session.
    • Walks React component properties and hook state searching for objects exposing postOrder, createOrder, or createMarketOrder, plus the associated signer — application-specific logic targeting Polymarket's trading workflow.
    • Queries balances/positions, computes portfolio value, applies thresholds (fallback total-value threshold 10, per-position threshold 10), and checks Polymarket's geoblock response, exiting if blocked.
    • Two paths to redirect value: submitting SELL orders at increasingly aggressive prices then transferring proceeds, or building an ERC-1155 batch transfer of position tokens to the configured recipient.
    • Constructs EIP-712 DepositWallet batch messages for Polygon, requests signatures through the existing signer, and submits signed batches to Polymarket's relayer, with conversion/swap routes and a direct token-transfer fallback.
    • Beacons wallet addresses, IP/country, OS, account type, portfolio values, position summaries and transfer results to data.debugbear[.]com via /metrics/submit, /metrics/update, /metrics/handle.
    • CDN Last-Modified header reported October 27, 2026 12:50:43 GMT; two retrievals (18:12:06 and 18:13:04 UTC) returned byte-identical content. A WhoGetsMyData scan dated October 29 independently records Polymarket loading the URL and allowing the host in its CSP.

    Remediation

    • Users: reject unexpected signing/approval prompts; close exposed tabs; review recent orders, positions and on-chain transactions from a clean session; retain timestamps and transaction hashes; review sessions, API credentials and on-chain approvals (disconnecting a wallet does not revoke approvals or reverse transfers); never share a seed phrase and avoid unsolicited "recovery" links.
    • Defenders: preserve exact response bytes, hashes, HTTP metadata and loader references before CDN content changes; remove unnecessary third-party integrations from authenticated trading and signing flows; pin assets with Subresource Integrity alongside a restrictive Content Security Policy; audit the signer boundary so untrusted page code cannot reach the signing interface without fresh user confirmation.