Polymarket DebugBear Hack: $2.7 Million Drained Through a Hijacked Page-Speed Script
Polymarket’s international exchange lost about $2.7 million on Thursday, October 29, 2026, after a hijacked page-speed script turned logged-in traders’ own browser sessions against them. That’s the short version of the Polymarket DebugBear hack, and it’s worth reading slowly, because no smart contract broke and no password was cracked. Reports published November 1 put the affected count at 726 wallets and total refunds at about $3.9 million, a figure that includes $2.7 million returned to drained wallets plus about $1.19 million for roughly 5,500 wallets hurt by the trading pause. Polymarket halted trading for about an hour on October 29, then brought the international platform back online the same afternoon. ...