HackFraudPolymarket frontend supply-chain attack drains ~$2.6M
Published: 29 Oct 2026 · Worldwide
Attackers compromised a third-party Real User Monitoring script (DebugBear RUM) loaded on Polymarket's international site. The malicious JS (cdn[.]debugbear[.]com/C7xcKKrjUnXK[.]js) read localStorage auth data, hijacked React internals to create sell orders and signed DepositWallet batches via the user's own signer and Polymarket's relayer. Drained ~28.6M POL (~$2.6M) to attacker 0x3F99139F1C5854b
Who is at risk
Anyone who uses social media, email or messaging apps
How to protect yourself
- Do not click links in unexpected messages, posts or direct messages.
- Check the sender or account through the official website, not through the message.
- Never share passwords, codes or recovery phrases.
Source: Community reports (hackfraud.com)
Language: English Ελληνικά Español Français Deutsch Italiano Português Nederlands Polski Türkçe Русский العربية हिन्दी 中文 日本語