$2.7 Million Drained via DebugBear Script in Polymarket Supply Chain Hit

Polymarket detected unauthorized withdrawals on its international platform and immediately switched to cancel-only mode before suspending relayer actions. The firm identified a third-party compromise, referred the case to law enforcement, and pledged full reimbursement. Trading resumed within an hour on the unaffected US platform. DebugBear confirmed the incident and instructed customers to remove its RUM snippet. Hudson Rock recovered the injected script, which scanned for logged-in trading tools and portfolio data before routing position tokens or sale proceeds to a hardcoded attacker address. GoPlus on-chain tracing linked the flows through 710 deposit wallets to a primary recipient holding approximately $2.65 million. Neither firm found evidence of credential exfiltration or targeting of other DebugBear clients. The attack repeats Polymarket's June 2024 frontend injection that cost roughly $3 million and occurred the same day blockchain firms attributed a $6 billion Binance incident to North Korea-linked actors. Official statements emphasize isolated vendor compromise while independent analysis shows repeated reliance on unvetted third-party scripts without disclosed vendor due diligence. Reimbursement timelines and any DebugBear customer notifications remain undisclosed. Law enforcement referral offers no public attribution path. Expect further wallet clustering analysis and potential civil recovery attempts within 60 days.