<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
  <channel>
    <title>Ohey research</title>
    <link>https://ohey.ca/research/</link>
    <atom:link href="https://ohey.ca/research/rss.xml" rel="self" type="application/rss+xml"/>
    <description>Web threat research from Ohey: incident write-ups with timelines, code analysis and indicators.</description>
    <language>en-ca</language>
    <item>
      <title>Polymarket wallet drainer served from DebugBear&apos;s script CDN</title>
      <link>https://ohey.ca/research/polymarket-debugbear-wallet-drainer/</link>
      <guid isPermaLink="true">https://ohey.ca/research/polymarket-debugbear-wallet-drainer/</guid>
      <pubDate>Thu, 29 Oct 2026 00:00:00 GMT</pubDate>
      <description>A DebugBear monitoring script on Polymarket became a wallet drainer on 29 October 2026 and sent 28.6M POL and 33 accounts&apos; positions to a single wallet.</description>
    </item>
  </channel>
</rss>
