Affected Systems

Polymarket.com users who visited the platform while DebugBear's compromised Real User Monitoring (RUM) JavaScript (cdn.debugbear[.]com/C7xcKKrjUnXK.js) was embedded. Any organization using DebugBear RUM service is potentially affected. Approximately $2.5 million traced to attacker wallet; total victim count undisclosed.

Exploitation Status

Active exploitation confirmed. Malicious JavaScript was distributed via compromised DebugBear CDN infrastructure between approximately 1:50 p.m. and 2:05 p.m. ET on October 29, 2026. Attacker wallet (0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18) conducted numerous transactions draining cryptocurrency and prediction-market tokens. Incident resolved by 3:05 p.m. ET same day.

Business Impact

Supply chain compromise affecting third-party monitoring service DebugBear enabled attackers to inject malicious JavaScript into customer websites. For Polymarket users, the script hijacked authenticated sessions, liquidated prediction-market positions, and transferred cryptocurrency to attacker-controlled wallets. Organizations using DebugBear RUM are at risk of similar session hijacking and credential theft. DebugBear's website is currently offline. Polymarket has committed to full reimbursement of affected users, but reimbursement process and total victim count remain undisclosed.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately remove DebugBear RUM embed code from all websites if currently deployed; verify removal via source code inspection and network traffic analysis
  • Audit web application dependencies and third-party JavaScript includes for DebugBear references (cdn.debugbear[.]com); check build logs and commit history for removal confirmations
  • Monitor blockchain transactions and wallet activity for Polymarket users; search logs for connections to cdn.debugbear[.]com/C7xcKKrjUnXK.js and data.debugbear.com between October 29, 1:50 p.m. and 3:05 p.m. ET
  • Review Content Security Policy (CSP) headers to restrict third-party script execution and implement Subresource Integrity (SRI) checks for external JavaScript resources
  • Assess supply chain risk for all third-party monitoring and analytics services; implement runtime script integrity monitoring and anomaly detection for session hijacking attempts