Affected Systems

Polymarket prediction market platform users. Attack vector: DebugBear RUM (Real User Monitoring) third-party JavaScript loaded on Polymarket's website. DebugBear DNS records compromised via domain registrar, redirecting cdn.debugbear[.]com to attacker-controlled server. 726 wallets directly affected; approximately 5,500 additional wallets impacted by trading pause.

Exploitation Status

Active exploitation confirmed. Attack occurred October 29, 2024, between 17:10 and 18:02 UTC. Malicious script was live for under one hour. Attackers successfully exfiltrated approximately $2.64 million in POL tokens from 33 wallets during the attack window. No ongoing exploitation; malicious DNS records removed and script taken offline by October 30.

Business Impact

High-impact supply chain compromise demonstrating risk of third-party JavaScript on financial platforms. Malicious code leveraged existing user sessions to execute unauthorized trades and fund transfers without stealing credentials. Attack reused in-browser API keys and wallet signers to sell positions and drain funds. Polymarket refunding $3.9 million total ($2.7M direct theft, $1.19M collateral losses). DebugBear customers remain at risk if RUM script still embedded. No CVE assigned. Attack method bypassed traditional authentication controls by hijacking legitimate session context and transaction signing mechanisms already authorized by users.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately audit all third-party JavaScript loaded on authenticated pages, especially financial or transaction-enabled sites; remove DebugBear RUM embed code per vendor advisory
  • Implement Subresource Integrity (SRI) hashes for all pinned third-party scripts to detect content tampering; browsers will reject files if hash mismatches
  • Strengthen Content Security Policy (CSP) to restrict script sources and sandbox third-party code; whitelist specific file hashes rather than entire CDN domains
  • Review DNS records and domain registrar security for all critical external dependencies; enable registrar-level MFA and transfer locks
  • Train users to reject unexpected wallet signing prompts; monitor for anomalous transaction patterns such as rapid position liquidation or fund transfers to unknown addresses