How We Protect Our JavaScript Agent, and How to Host It Yourself
On October 29, a web performance script started emptying Polymarket wallets. The script belonged to DebugBear, a performance monitoring service a lot like Request Metrics. Polymarket ran it to measure how fast its site loaded for real visitors. Scott Helme’s analysis shows that cdn.debugbear.com stopped serving DebugBear’s script. An nginx server answered in its place with a script built to drain Polymarket accounts.