Polymarket Users Lose $2.7 Million in Third-Party Script Hack

Polymarket Users Lose $2.7 Million in Third-Party Script Hack 🚨

Prediction market platform Polymarket briefly halted trading on its international exchange on Thursday, October 29, after users reported unauthorized withdrawals from their wallets. Blockchain analytics firms Betting Intelligence and Polysights estimated that attackers took about $2.7 million from 710 wallets. The incident involved a compromised third-party performance-monitoring script supplied by DebugBear, a UK-based website performance vendor whose code ran on Polymarket.com.

In its post-incident update, Polymarket stated that the attacker replaced DebugBear’s monitoring script with malicious code designed to target its users. For users who had Polymarket open during a short window, the script used their active sessions to sell trading positions and move funds out of their wallets. The incident didn’t involve a reported breach of Polymarket’s smart contracts; instead, attackers reportedly abused a trusted third-party script running on the website. Polymarket removed the compromised code, cleared its caches, paused trading and relayer actions, and reset active login sessions. The platform moved into cancel-only mode at around 2:00 p.m. ET and resumed trading at 3:00 p.m. ET. Its separate US platform was not affected.

Polymarket referred the incident to UK law enforcement and pledged to reimburse affected traders. By Friday afternoon, it said 95% of affected wallets had been refunded. The company stated it was returning $3.9 million in total: $2.7 million for stolen funds and another $1.2 million to cover losses linked to the trading pause. “In total, we’re returning $3.9M to traders: the $2.7M plus $1.2M to cover pause-related losses. No claims or tickets needed: we identified eligible wallets from on-chain and trading data,” the company stated in its update. Users whose losses were below $10,000 were due to receive refunds by October 30, while those with larger losses were asked to complete a release form.

This was also Polymarket’s second reported third-party website compromise this year. In June, attackers used malicious code injected through a vendor to steal about $3 million from users. Security professionals note that managing third-party web scripts remains a tough problem for online platforms. Gareth Bowker, Head of Information Security at Jscrambler, explained, “The malicious script exchanged data with a server on DebugBear’s own domain. A content security policy that permits a trusted vendor’s domain would have allowed that traffic. Organizations also need to monitor what third-party code does in the browser at runtime.” Bowker added, “Users should still review their transaction history and revoke any token approvals they do not recognize. A user cannot reasonably detect a malicious script on a trusted site. Control over what runs on that site is the platform’s responsibility.”

To read the complete article see: Read full article