Heads up to anyone who has traded on or visited Polymarket today.

Security researchers at Hudson Rock just published an alert detailing a supply chain compromise that directly targeted Polymarket users via a third-party performance-monitoring script.

Here is a breakdown of what happened, how it worked, and what you need to do:

What Happened?

Polymarket was using DebugBear RUM (a tool normally used to track site speed and performance). The hosted CDN script for this integration (cdn.debugbear[.]com/...) was altered to include a custom wallet-draining and asset-theft payload designed specifically for Polymarket’s web app.

How Did the Drainer Work?

Instead of just logging latency, the injected JavaScript:

1. Checked for active, logged-in user sessions in the browser.
2. Hooked into Polymarket’s frontend trading client and signer instances.
3. Inspected the user's open positions and available portfolio balances.
4. Attempted to liquidate/sell positions and siphon the proceeds out to an attacker-controlled fallback wallet.

Financial Damage

• At least one trader has already reported an $800,000 loss tied directly to the incident.
• The fallback wallet address hardcoded in the malicious payload currently holds over $2,000,000, though total losses across all victims are still being tallied.

Current Status & Remediation

Polymarket pushed an emergency production build removing the dependency entirely (commit log: chore(polymarket): remove debugbear rum script (#15337)). Subsequent homepage snapshots confirm the script reference has been removed from the live site.

However, how the CDN or DebugBear account was initially breached, the exact window of exposure, and how many browser sessions executed the payload before it was pulled remain unconfirmed.

Recommended Actions:

• Check your Polymarket activity: Verify your order history, active bets, and USDC balance immediately.
• Review wallet approvals: If your connected Web3 wallet interacted with Polymarket during the incident window, use tools like Revoke(.)cash to check and revoke any suspicious token approvals or session permissions.
• Clear site cache/data: Force-refresh and clear browser cache/cookies for Polymarket to ensure no stale cached scripts linger in your browser session.

Will update as official post-mortems or further statements come out. Stay safe out there.