Polymarket traders drained after DebugBear monitoring script compromised
Original title: $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack
Trading on the international site paused for about an hour on October 29, and Polymarket says affected users will be reimbursed.
Polymarket halted international trading on October 29 after users reported unauthorized withdrawals, then resumed about an hour later and promised to make affected traders whole. It said a third-party provider was compromised and referred the case to law enforcement, without naming the vendor or stating losses. Researchers tie the theft to malicious JavaScript from DebugBear’s real-user-monitoring snippet, which tried to sell positions or send tokens using an already logged-in session. Reported totals differ, and the US platform was reportedly unaffected.
Unconfirmed: Loss totals are unverified and differ by source; how the script was altered and how many users were hit is unknown.
- DebugBear told RUM customers to remove its website snippet.
- Hudson Rock saw about $2.19 million at a hardcoded fallback address.
- GoPlus estimates roughly $2.71 million; Arkham shows about $2.65 million.
- GoPlus traced the main path through 710 deposit wallets and 731 addresses.
- A June third-party frontend compromise was previously reported at about $3 million.
Impact: Unauthorized sale or transfer of logged-in traders’ positions
- 1.Remove the DebugBear real-user-monitoring snippet from affected websites.
- Vendors
- DebugBear
- Products
- DebugBear RUM
- Victims
- Polymarket
- Organizations
- Hudson RockGoPlusArkham
From the original article
2 min read at securityweek.com
Malicious code linked to a website monitoring tool was designed to hijack logged-in Polymarket sessions and siphon user funds. The post $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.