{
  "id": 17556851,
  "title": "Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script",
  "url": "https://urgent.news/2026/11/01/hackers-steal-about-2-7-million-from-polymarket-traders-via-hijacked",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-01T07:25:40.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/11/hackers-steal-about-27-million-from.html"
  },
  "original_language": "en",
  "account": "On October 29, hackers stole approximately $2.64 million from Polymarket traders by hijacking a DebugBear script that Polymarket used to measure web page load times. The malicious code replaced the legitimate script, allowing the hackers to access trader positions and move funds to their own crypto wallet. Polymarket refunded about $2.7 million to 726 affected wallets, with the remaining $1.19 million paid to traders who lost money during the trading pause. DebugBear, which provides a RUM tool for web page load speed, experienced compromised DNS records due to a domain registrar issue. Researchers found that the malicious file removed DebugBear's script and accessed the trader's API keys and trading permissions to take positions. Polymarket is strengthening its security measures, including implementing a stronger Content Security Policy, pinned versions, and sandboxing. The company has also referred the case to law enforcement.",
  "summary": "Malicious code on the website of prediction market Polymarket sold some signed-in traders' positions and moved their funds to the hackers on October 29. The code had replaced a page-speed script that the site loaded from an outside company. Polymarket says it is refunding about $2.7 million to 726 affected wallets. Blockchain records show crypto worth about $2.64 million reached",
  "key_points": [
    "Hackers stole $2.64 million from Polymarket traders",
    "Malicious code hijacked DebugBear script for fund access",
    "Polymarket refunded $2.7 million to affected wallets"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}