Polymarket has halted trading on its global marketplace on October 29 after users reported over $2 million being withdrawn without authorisation. The issue was caused when a third party provider was compromised and malicious code was injected which exploited authorised user sessions to withdraw funds.
The prediction market first put their global marketplace into cancel only mode. However trading resumed around an hour later after they said they had “identified and resolved the issue.” Polymarket confirmed that they had reported the incident to law enforcement and would compensate those affected.
They have not yet identified the third party provider or confirmed how much was lost.
The attack was attributed to malicious JavaScript from DebugBear, a UK based website performance monitoring company. Polymarket’s US marketplace was not impacted.
DebugBear admitted they were currently responding to a security incident and requested that customers using their real user monitoring (RUM) product remove their script from their website. They also said specialised incident response teams had been deployed.
A copy of the malicious JavaScript was obtained by cybersecurity firm Hudson Rock. They identified that the script was searching for trading tools and portfolio data. Depending on the account type, the script would attempt to sell positions and move the funds or move the position tokens directly to the attacker controlled address.
Although the code was looking for credential related data, Hudson Rock noted that there was no routine to pass on passwords, seed phrases, private keys or credential maps to their reporting endpoint.
This attack was exploiting existing permissions.
The researchers identified a production build of the Polymarket platform with a timestamp of 17:59 UTC. This included a note that the DebugBear script had been removed.
It is unclear how much was stolen. Hudson Rock analysed a screenshot that showed around $2.19 million at an address hard-coded into the malicious script as a fallback destination, but cautioned that the figure was not a verified loss total.
Blockchain security firm GoPlus estimated the losses at roughly $2.71 million had been stolen. They identified there were 710 deposit wallets and 731 addresses within the main attack path. This does not indicate how many individuals were affected.
Arkham data shows there was a suspected attackers wallet with around $2.65 million.
Hudson Rock have not identified how the malicious code was added or how many users were affected.
Their investigation has also not found any evidence that other DebugBear customers were targeted.
This incident happened on the same day that Binance suffered a hack of around $6 billion, which blockchain intelligence firms attributed to North Korea. Polymarket had also disclosed a third-party security breach in June, when a malicious script was injected into its frontend and reportedly resulted in losses of around $3 million.
Read the original article:
Polymarket Traders Lose More Than $2 Million in Supply Chain Attack Involving DebugBear