---
title: Polymarket halts trading after a compromised third-party script drained user wallets; DebugBear, a web-performance monitoring firm, tells RUM customers to pull its embed code | ctxsec
url: https://ctxsec.com/items/polymarket-debugbear-rum-script-compromise-wallet-drain
description: ""
status: "official (Polymarket and DebugBear statements on X, Oct 29); DebugBear named as the provider by Reuters/CNBC sources; loss figure from on-chain data, not confirmed by Polymarket"
published: 2026-10-29
---

> 

[← Cybersecurity News](/news) · [markdown](/items/polymarket-debugbear-rum-script-compromise-wallet-drain.md)

official (Polymarket and DebugBear statements on X, Oct 29); DebugBear named as the provider by Reuters/CNBC sources; loss figure from on-chain data, not confirmed by Polymarket

2026-10-29

### Polymarket halts trading after a compromised third-party script drained user wallets; DebugBear, a web-performance monitoring firm, tells RUM customers to pull its embed code

Polymarket said on Oct 29 that "one of our 3rd party providers was compromised," that it had identified and fixed the issue on its international site, referred it to law enforcement, and that anyone affected "will be made whole." It halted trading for about an hour and resumed around **3 PM ET**, saying it is "fully reimbursing all affected traders." Its U.S. platform was not affected, per CNBC.

- **The provider:** DebugBear posted at 18:00 UTC that it was "impacted by an ongoing security incident" and that customers using its **RUM** (real-user monitoring) product should remove the embed code from their sites. Reuters and CNBC sources identify DebugBear as Polymarket's compromised provider.
- **The payload (Hudson Rock):** a script served from DebugBear's CDN looked for a logged-in Polymarket trading session, built signed batch requests to sell positions and move funds, and hard-coded a fallback recipient wallet. Polymarket's production build records a commit removing the DebugBear script. Hudson Rock has not established how DebugBear was compromised or how many users were hit.
- **Losses:** The Block and Decrypt, citing Arkham, report about **$2.65 million** in POL sitting at the suspected attacker wallet. Polymarket has not given a figure.

**Why it matters beyond crypto:** any third-party script on a page runs with that page's full privileges, including signed-in sessions. Other DebugBear RUM customers should remove the snippet now and review what it could reach. See the playbook and tip below.

Sources: [Polymarket Traders on X: third-party provider compromised, referred to law enforcement, impacted users made whole (Oct 29, 18:33 UTC)](https://x.com/PolymarketTrade/status/2115874609014726842) · [Polymarket Traders on X: trading fully back online, reimbursing all affected traders (Oct 29, 19:00 UTC)](https://x.com/PolymarketTrade/status/2115881498477785393) · [DebugBear on X: impacted by an ongoing security incident; RUM customers should remove the embed code (Oct 29, 18:00 UTC)](https://x.com/DebugBear/status/2115866496643535293) · [Hudson Rock / InfoStealers: wallet-draining code found in a third-party script (Oct 29)](https://www.infostealers.com/article/polymarket-breach-alert-wallet-draining-code-found-in-a-third-party-script/) · [CNBC: Some Polymarket user funds stolen, matter referred to UK authorities (Oct 29)](https://www.cnbc.com/2026/10/29/polymarket-reports-outage-on-international-exchange-halts-trading.html)