Polymarket frontend drain via compromised DebugBear script (29 Oct 2026): about $2.7M lost per DeFiLlama, paid out in POL to attacker 0x3F99…fc18

• Scam type: Hack
• Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
• Project or site name: Polymarket
• Incident date: 2026-10-29
• Reported: 2026-10-30
• Last updated: 2026-10-30

On 29 October 2026, Polymarket's international site (polymarket[.]com) loaded a third-party monitoring script from the vendor DebugBear that had been altered to drain users. The script, served from cdn.debugbear[.]com/C7xcKKrjUnXK.js, used visitors' logged-in Polymarket sessions to sell their positions and send the proceeds and outcome tokens to the attacker. DeFiLlama's hacks list (https://defillama.com/hacks) puts the loss at about $2.7 million. Polymarket said one of its third-party providers was compromised, put the exchange in cancel-only mode and paused trading, then resumed trading,…