Polymarket users lose $2.7M after DebugBear third-party monitoring script is replaced with malicious code
Prediction market platform Polymarket halted trading on its international exchange on October 29 after users reported unauthorized withdrawals. Analytics firms Betting Intelligence and Polysights estimated about $2.7 million was drained from 710 wallets. The attacker replaced the monitoring script supplied by UK vendor DebugBear with malicious code that abused users' active sessions. Polymarket says it will return $3.9M in total and referred the incident to UK law enforcement.
Detalhes técnicos
- The compromised DebugBear real-user monitoring (RUM) script ran on Polymarket.com. The attacker swapped it for malicious code targeting Polymarket users.
- For users with Polymarket open during a short window, the script used active sessions to sell trading positions and move funds out of their wallets.
- No smart contract breach was reported.
- The malicious script exchanged data with a server on DebugBear's own domain, so a CSP allowing the vendor domain would have permitted the traffic. Subresource integrity is of limited use because vendors update RUM scripts frequently (Jscrambler's Gareth Bowker).
- This is Polymarket's second reported third-party compromise this year. In June, malicious code injected via a vendor was used to steal about $3M. In April, the platform rejected a claim of 300,000 stolen user records.
Remediação
- Polymarket removed the compromised code, cleared caches, paused trading and relayer actions, and reset active login sessions. It entered cancel-only mode around 2:00 p.m. ET and resumed trading at 3:00 p.m. ET. The US platform was not affected.
- DebugBear asked RUM customers to remove the embedded code.
- Polymarket is returning $3.9M ($2.7M stolen plus $1.2M for pause-related losses). 95% of affected wallets were refunded by Friday. Losses under $10,000 were refunded by October 30, and larger losses require a release form.
- Users should review transaction history and revoke unrecognized token approvals. Organizations should monitor third-party code behavior at runtime.
Linha do tempo
-
Polymarket users lose $2.7M after DebugBear third-party monitoring script is replaced with malicious code
ler a análise desta fonte ocultar
Prediction market platform Polymarket halted trading on its international exchange on October 29 after users reported unauthorized withdrawals. Analytics firms Betting Intelligence and Polysights estimated about $2.7 million was drained from 710 wallets. The attacker replaced the monitoring script supplied by UK vendor DebugBear with malicious code that abused users' active sessions. Polymarket says it will return $3.9M in total and referred the incident to UK law enforcement.
Technical Details
- The compromised DebugBear real-user monitoring (RUM) script ran on Polymarket.com. The attacker swapped it for malicious code targeting Polymarket users.
- For users with Polymarket open during a short window, the script used active sessions to sell trading positions and move funds out of their wallets.
- No smart contract breach was reported.
- The malicious script exchanged data with a server on DebugBear's own domain, so a CSP allowing the vendor domain would have permitted the traffic. Subresource integrity is of limited use because vendors update RUM scripts frequently (Jscrambler's Gareth Bowker).
- This is Polymarket's second reported third-party compromise this year. In June, malicious code injected via a vendor was used to steal about $3M. In April, the platform rejected a claim of 300,000 stolen user records.
Remediation
- Polymarket removed the compromised code, cleared caches, paused trading and relayer actions, and reset active login sessions. It entered cancel-only mode around 2:00 p.m. ET and resumed trading at 3:00 p.m. ET. The US platform was not affected.
- DebugBear asked RUM customers to remove the embedded code.
- Polymarket is returning $3.9M ($2.7M stolen plus $1.2M for pause-related losses). 95% of affected wallets were refunded by Friday. Losses under $10,000 were refunded by October 30, and larger losses require a release form.
- Users should review transaction history and revoke unrecognized token approvals. Organizations should monitor third-party code behavior at runtime.