Supply-chain Compromise Drains $2.7M from Polymarket After DebugBear Script Hijack
A malicious change to a third-party page-speed script on Polymarket’s site allowed attackers to use signed-in traders’ browser sessions to sell positions and siphon funds on October 29. The injected code targeted only Polymarket’s copy of a DebugBear real user monitoring (RUM) script and moved crypto to an attacker-controlled wallet in under an hour. Polymarket says it will refund roughly $2.7 million to affected wallets and is returning a total…