[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fp6ACucawGUT_GCse4p96XnELX6E5H65hWTWHHSNtQi0":3},{"article":4,"iocs":47,"watch_terms":48,"solutions":49,"lesson":134},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"9bdd9660-a639-4a16-b9ae-3bab4b1b63d2","Polymarket Users Lose $2.7 Million in Third-Party Script Hack","polymarket-users-lose-2-7-million-in-third-party-script-hack-e26ffe","Polymarket confirms $2.7 million stolen through the compromised third-party script and pledges $3.9 million in refunds, including compensation for pause losses.","Polymarket's international exchange suffered a supply-chain attack when attackers compromised DebugBear's third-party performance monitoring script running on the platform. The malicious code hijacked 710 active user sessions to execute unauthorized fund transfers and position liquidations during a brief window on October 29, 2026. Polymarket halted trading, purged the compromised code, and committed to refunding $3.9 million in total losses, with 95% of affected wallets reimbursed by October 30.","Polymarket users lost $2.7M through compromised DebugBear monitoring script; platform refunded $3.9M total.","https:\u002F\u002Fhackread.com\u002Fpolymarket-users-lose-2-7m-third-party-script-hack\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002Fpolymarket-users-lose-2-7m-third-party-script-hack.jpg","2026-10-31T14:05:27+00:00","2026-10-31T15:00:09.671387+00:00",8,[17,20,23],{"name":18,"type":19},"Polymarket","product",{"name":21,"type":22},"DebugBear","vendor",{"name":24,"type":25},"Real-User Monitoring (RUM)","technology","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":26,"icon":28,"name":29,"slug":30},null,"Breaches","breaches",[32,37,42],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":43},{"id":44,"icon":28,"name":45,"slug":46},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",[],[21,18],{"controls":50,"vendors":133},[51,80,109],{"slug":52,"name":53,"problem":54,"products":55},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"splunk","Splunk","\u002Fvendor-logos\u002Fsplunk.png","enterprise-security","Splunk Enterprise Security","https:\u002F\u002Fwww.splunk.com\u002Fen_us\u002Fproducts\u002Fenterprise-security.html","SIEM for detection, investigation and response, on premises or in the cloud.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"guardsix","Guardsix","\u002Fvendor-logos\u002Fguardsix.png","guardsix-siem","Guardsix SIEM","https:\u002F\u002Fguardsix.com\u002Fproduct\u002Fsiem","SIEM with automation, developed and hosted in Europe.",{"slug":81,"name":82,"problem":83,"products":84},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",{"slug":110,"name":111,"problem":112,"products":113},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[114,122,127],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":123,"product_name":124,"url":125,"description":126},"jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":128,"product_name":129,"url":131,"description":132},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",[],{"slug":135,"title":136,"body":137,"framework_refs":138,"framework_notes":146},"third-party-script-compromise-drains-27m-from-polymarket-users","Third-Party Script Compromise Drains $2.7M from Polymarket Users","Attackers compromised a third-party performance monitoring script (DebugBear) integrated into Polymarket's platform, injecting malicious code that hijacked 710 active user sessions and executed unauthorized fund transfers. This is a classic supply-chain attack: the platform itself was not directly breached, but implicit trust in an external vendor's script gave attackers a foothold with significant user-level privileges. The incident highlights the systemic risk of loading third-party JavaScript directly into financial applications, where a single compromised dependency can affect hundreds of users simultaneously. Organizations must treat every third-party script as a potential attack vector and apply the same scrutiny to vendor code as to their own.",[139,140,141,142,143,144,145],"CIS Control 2: Inventory and Control of Software Assets","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST SP 800-53 SI-2: Flaw Remediation","DORA Article 9","CIS Control 17: Incident Response Management",{"DORA Article 9":147,"NIST SP 800-53 SI-2: Flaw Remediation":148,"CIS Control 17: Incident Response Management":149,"OWASP A06:2021 Vulnerable and Outdated Components":150,"CIS Control 2: Inventory and Control of Software Assets":151,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":152,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":153},"DORA mandates that financial entities manage ICT third-party risks and ensure the security of services provided by external providers, directly applicable to the uncontrolled trust placed in DebugBear's externally hosted script.","SI-2 requires organizations to identify, report, and correct information system flaws; a formal process covering third-party code integrity would have detected the script modification and triggered rapid remediation before significant losses occurred.","While Polymarket responded quickly, a pre-established incident response plan with automated trading halt triggers and predefined reimbursement procedures would have reduced the window of exposure and accelerated user protection.","This category directly covers the risk of relying on third-party components without validating their integrity; applying SRI checks and continuous monitoring of external dependencies would have detected or blocked the tampered script.","Maintaining an authoritative inventory of all software assets—including third-party scripts—would have ensured DebugBear's integration was tracked, reviewed, and subject to change-control processes before deployment.","This control requires organizations to assess and address vulnerabilities in all software in use, including third-party components, which would have mandated ongoing integrity verification of the DebugBear script.","Stronger session integrity controls—such as binding sessions to device context or requiring step-up authentication for fund transfers—would have prevented hijacked session tokens from being weaponized to execute unauthorized transactions."]