Polymarket frontend exploit via hijacked DebugBear monitoring script drained $2.6M in POL by executing unauthorized position sales.
Security & Exploits ·
On October 29, 2026, a compromised monitoring script served to Polymarket users drained approximately $2.6 million in POL tokens. The hijacked DebugBear RUM script executed unauthorized position sales without prompting users for wallet confirmation, routing proceeds through Polymarket's relayer infrastructure. The attacker's address accumulated 28.6 million POL—valued at roughly $2.64 million at the time—within 70 minutes of the incident's onset.
DebugBear's real user monitoring product is a standard performance-tracking tool embedded on websites to measure load times and responsiveness from visitor browsers. Because RUM scripts require full page privileges to function, they gain access to all other scripts and data on the same page, including Polymarket's trading client and withdrawal signers. The compromised script contained no legitimate monitoring code; it was purpose-built to extract local storage authentication data and API credentials, then traverse React's component tree to locate and execute unauthorized position sales.
Polymarket moved the exchange into cancel-only mode with relayer actions paused shortly after the drain began. This marks the exchange's second frontend compromise in four months and third security incident since May. The chain and recovered script snapshots show no smart contract vulnerabilities were exploited—the Conditional Tokens contract, order book, and exchange functioned as designed. Individual loss figures reported by affected traders remained unconfirmed by Polymarket at the time of initial disclosure.