Polymarket's CSP failed to stop $2.7 million vendor script attack
Attackers hijacked DebugBear's DNS records through its domain registrar and replaced a page-speed script that Polymarket's Content Security Policy already trusted. The swap occurred on October 29, but the incident was not detected until November 2, 2026. Because the URL remained unchanged, the CSP allowed the malicious script to execute despite its intended protections. Traders lost approximately $2.7 million. The hijacked script was a third-party performance-monitoring tool, not a core Polymarket product.
Polymarket's CSP was configured to trust DebugBear by URL, not by content hash, so the policy sat idle while attackers swapped legitimate code for malicious bytes. That design gap hands competitors like Kalshi and ForecastEx a sharp point of comparison: licensed custody infrastructure does not route user funds through third-party scripts at all.
The repeated vendor breaches this year strain Polymarket's treasury and force it to choose between deeper reserves or higher insurance premiums. Each payout also bleeds trust damage into the CFTC-regulated U.S. exchange operated through QCX LLC, since traders do not cleanly separate the two brands. Polymarket must now rebuild frontend security architecture or accept that rivals will keep citing its supply-chain losses.
This is Polymarket's fourth major security incident in recent coverage, after Polymarket refunds $3.9M after vendor script exploit drains user wallets and two other third-party breaches, deepening the pattern of supply-chain vulnerabilities that regulated competitors now use as a structural argument against crypto-native frontend architectures.