INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).
Polymarket Wallet-Draining Code Found in Third-Party Script
Executive Summary
AI-generated
A malicious JavaScript file was discovered in a third-party performance monitoring integration on Polymarket, containing sophisticated code designed to access authenticated trading sessions and transfer cryptocurrency assets to attacker-controlled addresses. The script, hosted on a DebugBear CDN URL, utilized techniques such as reading authentication context from local storage, traversing React component structures, and constructing EIP-712 signed messages to move assets. Analysis revealed the presence of T1059.007 - JavaScript (MITRE ATT&CK Technique), indicating a targeted attack against Polymarket users. The script's malicious capabilities were established through static analysis, with holdings exceeding $2.1 held by a fallback recipient address embedded in the script. Production build metadata from Polymarket confirms removal of the DebugBear integration, which was identified as the source of the malicious code, DebugBear (Identified Entity).
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Technical Observables 5 IoCs Login Required
Indicators of Compromise (IoCs) Protected
Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.
sha1 1
urls 1
sha256 2
domains 1
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope
Incident Timeline
Tactical Metrics
Intelligence Sources
AlienVault OTX
2026-10-30