Polymarket frontend drain via compromised DebugBear script (29 Oct 2026): about $2.7M lost per DeFiLlama, paid out in POL to attacker 0x3F99…fc18
- Scam type: Hack
- Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
- Project or site name: Polymarket
- Incident date: 2026-10-29
- Reported: 2026-10-30
- Last updated: 2026-10-30
On 29 October 2026, Polymarket's international site (polymarket[.]com) loaded a third-party monitoring script from the vendor DebugBear that had been altered to drain users. The script, served from cdn.debugbear[.]com/C7xcKKrjUnXK.js, used visitors' logged-in Polymarket sessions to sell their positions and send the proceeds and outcome tokens to the attacker. DeFiLlama's hacks list (https://defillama.com/hacks) puts the loss at about $2.7 million. Polymarket said one of its third-party providers was compromised, put the exchange in cancel-only mode and paused trading, then resumed trading,…
Other addresses in this report: 0xe4c4c39c1733e1c7c06b79f97ed442b68df41ec6, 0x5392587814ce8c6af6789764f88e5e9ab0b9962c, 0xc91ee0574a14446de200923729c349b9cae19b60