CampaignPublished 30 Oct 2026

Polymarket Breach Alert: Wallet-Draining Code Found in a Third-Party Script

Source AlienVault OTX General

Description

A malicious JavaScript file was found in a third-party performance monitoring integration on Polymarket. The script was designed to access authenticated trading sessions, inspect user portfolios, and transfer cryptocurrency assets to attacker-controlled addresses. It operates by reading authentication data from local storage, navigating React components to find trading functions, and creating signed messages to move assets. Polymarket has removed the compromised third-party integration. The extent of victimization and total losses are currently unknown.

Impact

The malicious script can compromise authenticated user sessions on Polymarket, enabling attackers to inspect portfolios and transfer cryptocurrency assets without user consent. This results in direct financial theft from affected users. The fallback attacker address holds assets exceeding $2.1 million, indicating potential significant financial impact. However, the total number of victims and aggregate losses remain unverified.

Defensive guidance

Polymarket has removed the compromised third-party DebugBear integration from their production environment, effectively mitigating this supply chain threat. Users and administrators should ensure that no other third-party scripts from DebugBear or similar sources remain active. No additional immediate action is indicated by the vendor advisory.

Summary

The threat involves a supply chain attack on Polymarket via a malicious JavaScript file hosted on a DebugBear CDN. This script targets authenticated users by accessing their browser sessions to identify active trading clients and signers. It reads authentication context from local storage and traverses React component structures to locate trading functionalities. Using this access, it constructs EIP-712 signed messages to sell positions or transfer tokens directly to attacker-controlled addresses. Static analysis confirmed the script's wallet-draining capabilities, with a fallback recipient address holding over $2.1 million. Polymarket's production build metadata confirms the removal of the DebugBear integration to mitigate this threat. No confirmed exploitation in the wild or victim counts have been reported.

Polymarket Breach Alert: Wallet-Draining Code Found in a Third-Party Script

Description

Impact

Defensive guidance

Summary

Indicators of compromise

Hashes 3

Community reviews

Description

AI analysisMachine-generated, updated 30 Oct 2026, 10:11 UTC

MITRE ATT&CK techniques14 from threat tags

Technical details

Indicators of compromise

Hashes 3

Community reviews

Related threats