An analysis of the October 29 Polymarket security incident showing how a compromised third-party domain registrar enabled malicious code injection via an external script, bypassing browser sessions to drain funds and positions.

On October 29, unknown individuals changed code on Polymarket’s website, replacing a file that the company was uploading from an external partner. The problem was started by DebugBear, a company that measures the speed of websites. According to DebugBear, its Internet address settings were compromised by the company that manages its names, while the company itself reported that it did not detect a breach in its own systems.

How did the code work?

The malicious code exploited the users' already active login on the page.…