conv.

All stories
SecurityQuiet 13d · day 13

Polymarket hit by wallet-draining malware in third-party script

Security researchers found code in a performance monitoring tool that stole user credentials and assets; $2M in holdings detected at attacker address.

newest coverage 13d agosummary written 12d ago2 pieces Google NewsNewswires

What to know

  • A malicious JavaScript file served through Polymarket's DebugBear integration could access user trading sessions, inspect portfolios, and transfer assets.
  • Polymarket removed the compromised integration from production build on October 29, the same day Hudson Rock confirmed the threat.
  • Over $2 million in holdings detected at the attacker's hardcoded address, though verified total losses and affected user count remain unknown.
  • The initial compromise mechanism and exact exposure window are still unresolved.

“This is evidence of substantial holdings at an address explicitly selected by the payload. It is not a verified accounting of the proceeds of this incident.”

Hudson Rock, Security researcher · InfoStealers ↗

Hudson Rock Security researcherPolymarket Affected platformVivian Community reporter

Polymarket hit by wallet-draining malware in third-party script
infostealers.com

How it unfolded 1 development · click the chart to see its coverage articles

Peak 1 piece in 3h at Oct 29, 3 PM; 2 pieces over 13 days (2 articles) Oct 29, 3 PM — 1 piece · 1 article — Google News 1Oct 29, 6 PM — 1 piece · 1 article — Newswires 1Oct 29, 9 PM — quietOct 30, 12 AM — quietOct 30, 3 AM — quietOct 30, 6 AM — quietOct 30, 9 AM — quietOct 30, 12 PM — quietOct 30, 3 PM — quietOct 30, 6 PM — quietOct 30, 9 PM — quietOct 31, 12 AM — quietOct 31, 3 AM — quietOct 31, 6 AM — quietOct 31, 9 AM — quietOct 31, 12 PM — quietOct 31, 3 PM — quietOct 31, 6 PM — quietOct 31, 9 PM — quietNov 1, 12 AM — quietNov 1, 2 AM — quietNov 1, 5 AM — quietNov 1, 8 AM — quietNov 1, 11 AM — quietNov 1, 2 PM — quietNov 1, 5 PM — quietNov 1, 8 PM — quietNov 1, 11 PM — quietNov 2, 2 AM — quietNov 2, 5 AM — quietNov 2, 8 AM — quietNov 2, 11 AM — quietNov 2, 2 PM — quietNov 2, 5 PM — quietNov 2, 8 PM — quietNov 2, 11 PM — quietNov 3, 2 AM — quietNov 3, 5 AM — quietNov 3, 8 AM — quietNov 3, 11 AM — quietNov 3, 2 PM — quietNov 3, 5 PM — quietNov 3, 8 PM — quietNov 3, 11 PM — quietNov 4, 2 AM — quietNov 4, 5 AM — quietNov 4, 8 AM — quietNov 4, 11 AM — quietNov 4, 2 PM — quietNov 4, 5 PM — quietNov 4, 8 PM — quietNov 4, 11 PM — quietNov 5, 2 AM — quietNov 5, 5 AM — quietNov 5, 8 AM — quietNov 5, 11 AM — quietNov 5, 2 PM — quietNov 5, 5 PM — quietNov 5, 8 PM — quietNov 5, 11 PM — quietNov 6, 2 AM — quietNov 6, 5 AM — quietNov 6, 8 AM — quietNov 6, 11 AM — quietNov 6, 2 PM — quietNov 6, 5 PM — quietNov 6, 8 PM — quietNov 6, 11 PM — quietNov 7, 2 AM — quietNov 7, 5 AM — quietNov 7, 8 AM — quietNov 7, 11 AM — quietNov 7, 2 PM — quietNov 7, 5 PM — quietNov 7, 8 PM — quietNov 7, 11 PM — quietNov 8, 2 AM — quietNov 8, 5 AM — quietNov 8, 8 AM — quietNov 8, 11 AM — quietNov 8, 2 PM — quietNov 8, 5 PM — quietNov 8, 8 PM — quietNov 8, 11 PM — quietNov 9, 2 AM — quietNov 9, 5 AM — quietNov 9, 8 AM — quietNov 9, 11 AM — quietNov 9, 2 PM — quietNov 9, 5 PM — quietNov 9, 8 PM — quietNov 9, 11 PM — quietYesterday, 2 AM — quietYesterday, 5 AM — quietYesterday, 8 AM — quietYesterday, 11 AM — quietYesterday, 2 PM — quietYesterday, 5 PM — quietYesterday, 8 PM — quietYesterday, 11 PM — quietToday, 2 AM — quietToday, 5 AM — quietToday, 8 AM — quietToday, 11 AM — quietToday, 2 PM — quietToday, 5 PM — quietToday, 8 PM — quiet 1
Oct 30Oct 31Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9yesterdaynow · 9:14 PM ET
  1. 1

    Wallet-draining code confirmed in performance monitoring tool

    Hudson Rock analysis confirms the DebugBear script searched for logged-in users' trading clients, inspected portfolios, and attempted to sell or transfer assets. The script had a fallback recipient address containing over $2 million in holdings at the time of review.

    “A performance-monitoring integration should measure how quickly a page loads. The JavaScript…does something far more consequential: it searches for a logged-in user's trading client, inspects their portfolio, and attempts to sell or transfer their assets.”
    — Hudson Rock
    1. 1 outlet Polymarket Breach Alert: Wallet-Draining Code Found in a Third-Party Script

      first by InfoStealers, 13d ago

  2. background

    Hudson Rock researchers retrieve malicious script from Polymarket integration — Security researchers downloaded JavaScript from cdn.debugbear[.]com/C7xcKKrjUnXK.js and confirmed it contained code designed to access trading sessions, inspect portfolios, and redirect assets. A second retrieval minutes later returned identical bytes.

  3. background

    Polymarket removes DebugBear script from production build — Polymarket's build metadata records the removal of the DebugBear integration with change message 'chore(polymarket): remove debugbear rum script (#15337)' timestamped 17:59:20 UTC. The removal indicates Polymarket had detected and responded to the compromise.

  4. background

    Researchers unable to confirm total losses or affected user count — While $2.19 million in holdings was detected at the attacker's hardcoded address, Hudson Rock states the exact exposure window, number of affected users, and aggregate verified losses remain unresolved. Initial compromise mechanism also unclear.