Hackers steal $2.7 million from Polymarket via hijacked DebugBear script
Original title: Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script
Malicious DebugBear script replaced on Polymarket stole $2.64 million from 726 traders; exchange refunding $3.9 million total.
On October 29, attackers replaced Polymarket's DebugBear page-speed script with malicious code that reused traders' signed-in browser access and signers to sell positions or move funds. The wallet received 28.6 million POL tokens worth $2.64 million in under an hour. Polymarket removed the script within an hour, paused trading, cleared cache, and is refunding $3.9 million to affected wallets.
Unconfirmed: Whether the DebugBear domain registrar breach affected other customers
- 726 affected wallets
- 28.6 million POL tokens stolen
- Script removed within an hour
- Refunds totaling $3.9 million paid
- Hackers' wallet received funds in under an hour
Impact: unauthorized access to traders' positions and funds
- 1.Implement stronger Content Security Policy for third-party scripts
- 2.Use pinned versions and sandboxing
- 3.Check for unexpected signing requests
- Vendors
- DebugBearPolymarket
- Products
- website
- Victims
- Polymarket traders
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | debugbear.com | r websites. The address that served the malicious file, cdn.debugbear[.]com, had no DNS record when The Hacker News checked on Novemb |
From the original article
4 min read at thehackernews.com
Malicious code on the website of prediction market Polymarket sold some signed-in traders' positions and moved their funds to the hackers on October 29. The code had replaced a page-speed script that the site loaded from an outside company. Polymarket says it is refunding about $2.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.