Polymarket is addressing a recent security incident by reimbursing $3.9 million to affected traders. This comes in the wake of a supply chain attack that led to unauthorized withdrawals. DebugBear, a web performance monitoring firm, has revealed that its DNS records were compromised during the incident.
Details of the Security Breach
On October 29, Polymarket halted trading on its international platform following reports from users about illicit withdrawals. Research conducted by Hudson Rock indicated that malicious JavaScript from a DebugBear address was loaded onto Polymarket’s site. The script specifically targeted traders who were logged in, manipulating their portfolios by either liquidating positions or transferring assets to a wallet controlled by the attacker.
Although the script accessed credential-related data stored in browsers, Hudson Rock found no evidence of it transmitting passwords, seed phrases, or private keys to the attackers. Instead, the script utilized trading permissions from active sessions to conduct its operations.
Polymarket’s Response and Compensation
In an update on October 30, Polymarket announced that 726 wallets were affected, with most already compensated except for 37, which were under review. The company is also compensating traders who were affected by halted trades or actions taken by the malicious script, with payouts totaling $1.19 million across approximately 5,500 wallets. Combined with the direct theft of about $2.7 million, the total compensation reaches $3.9 million.
Polymarket has removed the compromised third-party provider and is actively investigating the incident alongside law enforcement. A comprehensive postmortem will be released once the investigation concludes.
DebugBear’s Investigation
DebugBear, whose Real User Monitoring (RUM) script helps measure website performance, has advised customers to remove the embed code as a precaution. The company reported that its DNS server records were compromised via its domain registrar, leading to the current email communication issues.
Preliminary findings suggest that the attackers targeted a specific customer’s website, although further details are pending. DebugBear has not disclosed how the attackers gained registrar-level access and is continuing its investigation. The company assures that its internal systems remain uncompromised.
This incident mirrors a similar event in June, when Polymarket faced a third-party provider compromise resulting in a $3 million theft.
The situation underscores the importance of robust cybersecurity measures and highlights ongoing vulnerabilities within digital marketplaces and their supply chains.
