Hudson Rock found wallet-draining code in a script file Polymarket.com loaded from DebugBear's CDN
Hudson Rock's static review of the retrieved file found code paths that, if executed in a logged-in trader's session, would attempt to sell or transfer positions. Polymarket put its international exchange into cancel-only mode and says affected users will be made whole.
A script file that Polymarket.com loaded from DebugBear's content delivery network contained code that could attempt to sell or transfer a trader's positions, Hudson Rock says. Its analysis is static: researchers read the code and did not run it.
The sequence, in UTC, starts before the halt. A production build stamped 17:59:20 no longer included the DebugBear monitoring script. Hudson Rock calls that a build time, not a containment time. At 18:00, DebugBear said on X it was "impacted by an ongoing security incident" and told RUM product users to remove the embed code.
By 18:06, Polymarket's status account said the exchange "is currently in cancel-only mode". At 18:12:06 and 18:13:04, Hudson Rock retrieved the same 15,187 byte file from the CDN with an identical SHA-256 hash. The file was still retrievable after the 17:59:20 build timestamp.
Polymarket said at 18:33 that it had "identified & fixed an issue impacting our international platform" and that "One of our 3rd party providers was compromised." It referred the matter to law enforcement. It said anyone impacted "will be made whole." Polymarket.us is a separate platform.
At 19:00 it posted that trading was "fully back online" and that it is "fully reimbursing all affected traders." That is roughly an hour after the cancel-only post.
Forbes reported that Reuters named DebugBear as the provider, citing an unnamed source.
In Hudson Rock's reading, the script takes three local-storage entries, including a map of trading API credentials. It then searches the page's React state for the live trading client. For an ordinary wallet, the code builds a batch transfer of ERC-1155 position tokens. For what Hudson Rock calls a magic wallet, the code has a path that would submit sell orders and then move balances.
Hudson Rock found no routine that sends the credential map, a password, a seed phrase or a private key to the reporting endpoint. Hudson Rock says the script contains code to report wallet addresses, IP and country, portfolio values and position summaries to data.debugbear[.]com. Hudson Rock warns against reading the file as selling everyone's holdings.
Two loss figures circulate, and neither is a verified total. Hudson Rock's only dollar figure is about $2.19 million shown at the script's hard-coded recipient address in a screenshot of unknown date. It calls that not a verified accounting. Web3 Is Going Great, a crypto incident tracker, estimates user losses of about $2.65 million and gives no method.
Hudson Rock advises potentially exposed users to review orders, position movements and wallet transactions. It says to do so from a clean session. For teams running signing pages, it recommends Subresource Integrity, which makes a browser reject a script whose hash has changed, plus a restrictive content security policy.
CTOL's view is that the record supports a third-party script incident, with code that could sell or move positions and a promised reimbursement. The evidence is the retrieved file, the later build and Polymarket's statements. It does not show how the vendor file was altered or how many accounts it reached.
A verified count of affected accounts or losses would quantify the incident. A post-incident statement from Polymarket or DebugBear could show how the file was altered and how widely it was served.