GoPlus: Approximately $2.71 million in Polymarket user assets stolen, attack source points to third-party monitoring service supply chain compromise

A vulnerability analysis published by the GoPlus Chinese community reported that on October 29 (UTC), a user asset theft incident occurred on the Polymarket international site. The RUM script of the third-party performance monitoring provider DebugBear was compromised via a supply chain attack, with malicious code injected into user pages to abuse trading and signing permissions for asset transfers.