On October 29, Polymarket experienced a significant security breach, prompting the suspension of trading on its global platform. Reports of unauthorized fund transfers led to the decision to switch the platform to cancel-only mode, halting all relayer activities immediately.
Immediate Response and Investigation
Polymarket quickly identified the breach’s source as a compromised third-party provider. The company took swift action by involving law enforcement and ensuring that all affected users would be reimbursed. The platform resumed trading approximately an hour later, although details about the compromised vendor and total financial losses remain undisclosed.
DebugBear’s Involvement
The breach has been linked to malicious code originating from DebugBear, a UK-based firm specializing in website performance monitoring. DebugBear confirmed the security incident, advising users of its real user monitoring (RUM) product to remove the affected code snippet. Despite the breach, Polymarket’s US operations were reportedly unaffected.
Hudson Rock, a cybersecurity firm, analyzed the malicious JavaScript used in the attack, noting that it was designed to exploit logged-in users’ trading tools and portfolios. The script attempted to liquidate positions or transfer tokens to an attacker-controlled address based on the account type.
Financial Impact and Analysis
The financial impact of the attack remains uncertain, with estimates varying between $2.19 million and $2.71 million. Blockchain security company GoPlus attributed the attack to a supply chain compromise of DebugBear’s RUM script. Their analysis revealed that the attack path involved 710 deposit wallets and 731 addresses, although the exact number of affected users is unknown.
Arkham’s data suggests that a suspected attacker wallet held approximately $2.65 million, aligning with the hardcoded fallback recipient address in the malicious script. Despite ongoing investigations, Hudson Rock has not determined the exact method of the script modification or the total number of affected users.
Context and Future Outlook
This incident coincided with a major hack on Binance on the same day, attributed to North Korean actors, resulting in a $6 billion loss. Polymarket had previously faced a similar third-party compromise in June, which led to over $3 million in losses. These incidents highlight the growing threat of supply chain attacks in the cryptocurrency sector, underscoring the need for enhanced security measures and vigilant monitoring to protect user assets.
