⚠️ Exploit Breakdown: Polymarket User Asset Theft On October 29 (UTC), user assets were stolen on Polymarket’s international site, Polymarket[.]com. A supply-chain compromise of third-party performance monitoring provider DebugBear’s RUM script delivered malicious code to user pages. The code abused users’ trading and signing permissions. Onchain analysis shows that the primary attack path involved 710 DepositWallets and 731 addresses, with approximately $2.71 million in losses. Address counts do not represent unique users. Polymarket subsequently stated that it had fixed the issue and restored service, pledging full reimbursement for affected traders. Refer to subsequent official announcements for actual reimbursement progress. 🔍 Attack flow: 1. The malicious script was delivered through: cdn.debugbear[.]com/C7xcKKrjUnXK.js 2. It read Polymarket session and account context, traversing React state to locate the existing trading client and signer. 3. It constructed malicious orders, ERC-1155 batch transfers, or EIP-712 DepositWallet batch messages, requested signatures through the existing signer, and submitted the operations to the Polymarket relayer. 4. USDC.e was swapped into POL through Relay Router and sent to the primary consolidation address hardcoded in the malicious script. 5. Funds were then distributed across multiple addresses. Some were bridged to Ethereum, swapped, and consolidated into ETH. How DebugBear was initially compromised—and exactly which publishing permissions were abused—has yet to be disclosed in an official postmortem. Attacker’s primary consolidation address: 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18 🛡️ Security recommendations: 1️⃣ If you used Polymarket[.]com during the affected window, close old tabs and access the site again on a trusted device through official channels. Do not continue using the trading client from a potentially compromised page. 2️⃣ Preserve evidence and check all assets, including stablecoins, POL, and ERC-1155 positions. Save transaction hashes, signature prompts, and browser records to support subsequent reimbursement and investigation. 3️⃣ Revoke session keys and onchain approvals you no longer need. Check for anomalous ERC-20/ERC-1155 approvals. Revoking approvals cannot recover assets already transferred out. 4️⃣ Watch for phishing scams exploiting the incident. Trust only information published through official channels. Never give passwords, verification codes, private keys, or seed phrases to supposed “reimbursement support,” and never pay “unfreeze” or “verification” fees.