Polymarket hack principle analysis: speed test script tampering, hacker sells shares on the platform.

According to PolyBeats monitoring, in the early hours of October 30, Polymarket's international site experienced an anomaly: multiple logged-in users discovered their positions were sold via pending orders, or first transferred out and then sold.

Multiple technical reviews point to the same mechanism: the international site's page embedded a third-party real user monitoring script, DebugBear, used to measure loading and experience. A malicious version was hosted on its CDN; the file itself had almost no speed-test logic, yet it would read login parameters, proxy wallets, and order book API keys from the browser, then send orders through the ordering client in the page.

There are at least two position-theft paths. One is email or Magic-type login: in most cases users see no additional wallet pop-up, and the script can use the hijacked session to send immediate-fill sell orders, selling positions within the original account. The other is external wallets such as MetaMask: the script constructs requests to batch transfer out conditional tokens, and users see a signature box; positions first go to the attacker's receiving address, then are processed. If the account holds more cash than positions, the script will first sweep the cash, route it through a quote router into POL, and send it to the receiving address.

X user Andrey_10gwei stated that the attacker created a new Polymarket account (nickname gfg44433), then transferred a portion of Yes/No shares from certain Polymarket markets from the receiving address into that account and sold them via pending orders, rather than selling everything directly in the original wallet. The account's funds were subsequently split across multiple Polygon and Ethereum addresses, with cross-chain and mixing operations appearing.