# @EvanLuthra: 995 Polymarket accounts drained via compromised DebugBear script

Source: https://x.com/EvanLuthra/status/2115897850752385373
Kiwi News: https://news.kiwistand.com/stories/EvanLuthra-995-Polymarket-accounts-drained-via-compromised-DebugBear-script?index=0x6ae3dc79f648baf24d9cff445c5efe585716d7b80afd78d4bcef38f8d916d261dbe515f9
Submitted by misha on 2026-10-29 UTC, 2 upvotes, 0 comments

## Summary

Polymarket users lost funds on Thursday after a compromised third-party script from DebugBear, a page-speed measuring tool, was loaded on the real Polymarket website, according to the post, which says 995 accounts were drained. The script reportedly sold open positions at discounted prices, swapped balances into POL and sent them to the attacker, whose wallet grew to $2M in about 45 minutes, with Conor Grogan's final count at $2.65M. Polymarket reportedly switched the exchange to cancel-only, paused its relayer and said affected users will be made whole. The post notes this is the third such hack this year, following about $700K lost in May and about $3M in June.

## Article

🚨995 Polymarket accounts just got drained through Polymarket's own website. Let me explain how, because this one should scare everyone in crypto.

No fake link. No shady airdrop. These people were on the real Polymarket dot com on Thursday.

Polymarket's site loaded a script from DebugBear, a tool whose only job is measuring how fast the page loads. Somebody poisoned it.

Once it was running in your browser, it grabbed your logged-in trading session and started dumping every open position you had, first at 3% under market, then at half price, then at the lowest price possible. Then it swapped the whole balance into POL and shipped it to the attacker. Stablecoins can be frozen. POL can't.

It even reported back after every hit. Your wallet, your country, your portfolio size, whether the transfer went through. All of it sent home through DebugBear's own data endpoints.

The attacker's wallet went from empty to $2M in about 45 minutes. Conor Grogan's final count was $2.65M.

One trader said he lost $800K and watched every position get sold. His friend got hit for $600K.

Polymarket flipped the exchange to cancel-only, paused the relayer and says everyone will be made whole. Credit where it's due.

But this is the third time this year. About $700K in May. About $3M in June, through a hacked third-party script, same as now.

I've been phished. I've been drained. Stay in crypto long enough and it happens to you. But the people on Thursday did nothing wrong. They opened the right website.

Not one of these three hacks touched a smart contract. We spent ten years making the blockchain unbreakable and then let a page speed tracker sit right next to people's money.