Polymarket loses $2.7M after third-party DebugBear script hijacked

Sun, 01 Nov 2026 17:05:59 +0000

Engineer — Plan: Classic Magecart-style supply-chain attack via a third-party page-speed script with access to authenticated sessions. Audit all third-party JavaScript loaded on authenticated pages, enforce Subresource Integrity (SRI) hashes, and review the scope/access of analytics and monitoring scripts this quarter.
SOC/IR — Learn: No IOCs, no ATT&CK mappings, and no detection specifics are provided; the technique (hijacked third-party JS draining authenticated user sessions) is worth cataloguing for future coverage of client-side supply-chain detections, but nothing actionable is available here.
Leader — Plan: A single compromised monitoring vendor script caused $2.7M in direct financial losses across 726 users — a concrete data point for third-party vendor risk discussions. Schedule a review of client-side script vendors that load into authenticated user sessions and confirm your vendor contracts address incident notification obligations.

Third-Party-Script on CuraSec