Hijacked DebugBear monitoring script drains about 2.7 million dollars from Polymarket trader wallets

Hudson Rock and Ohey reported that attackers hijacked DebugBear, a real user monitoring vendor whose page-speed script Polymarket loaded, by compromising its DNS through the domain registrar rather than breaching DebugBear itself. A malicious server answered for DebugBear's addresses and served code that reused a signed-in trader's session to read stored trading API keys and move positions to the attacker, selling at worsening prices for email-login accounts. Polymarket says 726 wallets were affected and about 2.64 million dollars in POL reached the attacker within an hour, and it is returning 3.9 million dollars in total. No keys or seed phrases were exfiltrated.

Check

Inventory third-party scripts on pages that handle signing or trading, pin them with Subresource Integrity, and remove any not strictly needed.

Affected

Sites loading third-party scripts on authenticated trading or signing pages can have those scripts swapped via vendor DNS compromise to hijack sessions and move funds.

Fix

Enforce a strict content security policy and Subresource Integrity, pin and sandbox third-party scripts, and have users reject unexpected signing requests.