The Hacker News reported on November 1 that a rogue file on Polymarket's site sold some logged-in traders' positions on October 29. It also moved their funds to the attackers. The file had replaced a page-speed script from DebugBear. Polymarket says it is repaying about $2.7 million to 726 wallets. The outlet also said blockchain records show about $2.64 million reached the attackers' wallet within an hour. The refund and that on-chain figure are measured differently, so they are not the same loss.
Hudson Rock researchers read the file without running it. The code searched the open page for the part that places orders and the signer that approves transactions. Wallet users had positions moved directly; email users had them sold first. Hudson Rock found no code sending out keys, passwords or seed phrases. DebugBear says its DNS records, which point its web names to servers, were hijacked through its registrar. It is still looking, and the first point of compromise is not independently confirmed. Hudson Rock has not verified user numbers or total losses.
Hudson Rock cites a public scan showing Polymarket's content security policy, its list of allowed sources, permitted the DebugBear host. Hudson Rock notes that allowing a trusted host does not check the file it serves. Who decides which outside scripts run on pages where users approve payments?