GoPlus: Polymarket was hacked due to DebugBear script being compromised by supply chain contamination

Security company GoPlus released a vulnerability analysis on social media, stating that the prediction market platform Polymarket's international site experienced a user asset theft incident. The RUM script from third-party performance monitoring service DebugBear was compromised by supply chain attacks, delivering malicious code to user pages and abusing their trading and signing permissions.

On-chain analysis shows that the main path involved 710 DepositWallets and 731 addresses, with losses of approximately 2.71 million dollars; the number of addresses does not represent the actual number of users. Polymarket's official statement later indicated that the issue has been resolved and services have been restored, while also promising full compensation to affected traders, with the actual compensation progress to be based on subsequent official announcements.