Polymarket halted its international platform on October 29 after users saw withdrawals they didn’t make. Trading came back about an hour later.
What happened
Polymarket says a third-party provider was compromised and everyone hit will be made whole. Researchers linked it to malicious JavaScript served from DebugBear, a UK web performance monitoring company. DebugBear confirmed an ongoing incident and told customers using its real user monitoring (RUM) snippet to pull it from their sites.
Hudson Rock says the script didn’t steal seed phrases or keys. It used the logged-in session to sell positions or send tokens to an attacker address. The U.S. platform was reportedly unaffected.
My take
Every third-party script on your page runs with your users’ full session. Keep the list short, pin what you load, and use Subresource Integrity where you can.
God Bless, and Use the Source!
