In a significant breach affecting the prediction market Polymarket, hackers managed to siphon approximately $2.7 million from traders’ accounts on October 29. The attack involved malicious code that replaced a page-speed script originally sourced from a third-party provider, leading to unauthorized transactions.
Details of the Security Breach
Polymarket has announced its commitment to reimbursing the affected traders, which include 726 wallets impacted by the breach. Blockchain analysis indicates that the stolen funds, valued at around $2.64 million, were transferred to the hackers’ wallet in less than an hour.
The compromised script was associated with DebugBear, a platform providing real user monitoring (RUM) services for website performance. Upon investigation, Hudson Rock researchers identified that the malicious file was downloaded from Polymarket’s site, following a modification that removed the legitimate DebugBear script.
How the Hack Was Executed
DebugBear reported that the breach occurred through a manipulation of its domain registrar records, potentially targeting a single customer. No evidence suggests a direct compromise of DebugBear’s systems, although investigations are ongoing. Ohey researchers noted a change in server responses for DebugBear’s scripts during the attack, which involved swapping Polymarket’s script hosted on Google Cloud Storage.
The malicious code exploited existing user access on Polymarket, using stored browser API keys to manipulate transactions. Although these keys alone couldn’t authorize trades, the code cleverly bypassed security by interacting with the site’s order and signature processes, redirecting funds to the attackers’ wallets.
Polymarket’s Response and Future Measures
Polymarket quickly acknowledged the unauthorized activity, pausing trading and implementing security measures such as removing the compromised script and resetting user sessions. As of October 30, the majority of affected wallets had been reimbursed, with efforts ongoing to address all impacted accounts.
To prevent future incidents, Polymarket has enhanced its use of third-party scripts by employing a stronger Content Security Policy (CSP), sandboxing, and version pinning. Hudson Rock advises platforms to limit third-party code on transaction pages and use Subresource Integrity (SRI) to prevent unauthorized file changes.
For individual traders, vigilance is key. Rejecting unexpected signing requests can provide an additional layer of protection against similar exploits.
