GoPlus: Polymarket Theft Tied to DebugBear Script Supply-Chain Compromise

Polymarket’s international platform suffered a user-asset theft after a supply-chain compromise involving a RUM script from third-party performance-monitoring provider DebugBear, according to a vulnerability analysis published on social media by security firm GoPlus. According to ChainCatcher, on-chain analysis identified a main path involving 710 DepositWallets and 731 addresses, with losses of about $2.71 million. The address count does not represent the number of affected users. Polymarket said it had fixed the issue and restored service, and pledged to fully reimburse affected traders. The reimbursement progress remains subject to subsequent official announcements.