# The performance script ran the book

2026-10-29

Polymarket halted its international CLOB for an hour after a compromised Real User Monitoring script used logged-in browser sessions to sell positions and move tokens. Researchers traced about $2.5–2.7 million across hundreds of wallets. The US venue was out. Polymarket says it will make traders whole. DebugBear told every other customer to pull the embed.

Canonical: https://www.fabiocti.com/notes/the-performance-script-ran-the-book/
Author: Fabio Correia

The beacon that was supposed to time the page load placed the orders.

Polymarket put the international exchange into cancel-only at 18:05 UTC, paused the relayer, and an hour later brought the CLOB back. Status page: a third-party provider was compromised, referred to law enforcement, anyone hit will be made whole. CNBC’s person says that provider is DebugBear, a UK Real User Monitoring shop, and that the referral is UK police. The US venue, they say, was not in it.

What the script did, from copies Hudson Rock and BleepingComputer pulled off DebugBear’s own CDN: look for a logged-in Polymarket session in the browser. Read balances and positions. If the session could trade, sell the book. If it could move the outcome tokens, transfer them. Convert whatever was left into something that would leave. Report wallet, IP, country, OS, book, and whether the transfer cleared — back through DebugBear’s metrics host, the same name the page already trusted for timing paint.

That is not a phishing page. That is the trading client, already authenticated, running a second trader in the same origin. Six minutes of Polymarket token-contract traffic, 17:50–17:56 UTC, then the halt. Researchers put about $2.5–2.7 million on a receiving wallet and, separately, about 710 wallets drained. Polymarket has not published a count. It has published a reimbursement. DebugBear told every other customer to rip the embed out. Its own site was a Cloudflare error by evening. Polymarket’s production build already had the removal in the commit message before the status page went orange.

A third-party front-end already took about this much off Polymarket in June. Different vendor. Same shape: the chain was fine. The page was not.

Cancel-only is the interesting control. The script is an agent that needs a live book and a live relayer. Kill the book and the agent is a loop with nowhere to send. That works until the next copy is sitting in a tab that loaded before the pull, or in a RUM tag some other desk has not read yet.

## What $2.7 million will be asked to cover

It will be briefed as Polymarket hacked, and as every prediction wallet on Polygon. It is a RUM script on the international front-end, using sessions that were already open. The US exchange is a different stack. Do not add Binance’s hot-wallet numbers to this. Different chain of trust. Different afternoon.

It will be briefed as a human clicking through 710 wallets. Six minutes is not 710 people. It is one payload in however many browsers still had the session. The next version does not need a compromised CDN ticket. It needs a loop that watches every script tag the internet still serves, 24/7, and acts while the status page is still on “investigating.” That loop is not a claim about this file. It is what this file already looks like.

If you were on polymarket.com this afternoon with a session up, treat the book as having been read. Their reimbursement is the letter. A connect that already knows the drained wallet and asks you to “re-sync the proxy” is not them.

The performance script ran the book. The chain did what the browser told it.