Polymarket repays $3.9M after supply chain attack; DebugBear says registrar DNS records were hijacked
Polymarket is returning $3.9 million to traders after a supply chain attack on October 29 that abused a third-party script. Monitoring vendor DebugBear has disclosed that its DNS records were compromised through its domain registrar, which let attackers serve malicious JavaScript from a DebugBear address that Polymarket's site loaded. The attackers appear to have targeted one customer specifically, though DebugBear calls this preliminary and has not named the customer. Polymarket has not named the compromised provider either.
Detalhes técnicos
- Malicious JavaScript was served from a DebugBear address loaded by Polymarket (per Hudson Rock). DebugBear's real user monitoring (RUM) script is used to measure page load performance.
- The script targeted logged-in traders. It checked their portfolios, then either dumped positions or moved assets to an attacker-chosen wallet.
- It read credential-related browser data, but Hudson Rock saw no evidence that passwords, seed phrases or private keys were exfiltrated. The script abused the trading permissions of the open session instead.
- 726 wallets were affected, with about $2.7M stolen directly. A further $1.19M is being paid to roughly 5,500 wallets hurt by the trading halt or by positions that were sold or transferred.
- DebugBear has not said how the registrar access was obtained. It reports no sign of compromise of its internal systems, and it cannot currently receive email on its domain.
- Polymarket had a similar third-party script injection incident in June, with about $3M in theft reported.
Remediação
- DebugBear initially told customers to remove the RUM embed code.
- Polymarket removed the compromised provider within the hour. It is working with law enforcement and has promised a postmortem.
- Defenders should lock down registrar accounts and DNS with MFA and registrar locks. They should also audit third-party scripts on sensitive web apps and consider Subresource Integrity or CSP controls.
Linha do tempo
-
Polymarket repays $3.9M after supply chain attack; DebugBear says registrar DNS records were hijacked
ler a análise desta fonte ocultar
Polymarket is returning $3.9 million to traders after a supply chain attack on October 29 that abused a third-party script. Monitoring vendor DebugBear has disclosed that its DNS records were compromised through its domain registrar, which let attackers serve malicious JavaScript from a DebugBear address that Polymarket's site loaded. The attackers appear to have targeted one customer specifically, though DebugBear calls this preliminary and has not named the customer. Polymarket has not named the compromised provider either.
Technical Details
- Malicious JavaScript was served from a DebugBear address loaded by Polymarket (per Hudson Rock). DebugBear's real user monitoring (RUM) script is used to measure page load performance.
- The script targeted logged-in traders. It checked their portfolios, then either dumped positions or moved assets to an attacker-chosen wallet.
- It read credential-related browser data, but Hudson Rock saw no evidence that passwords, seed phrases or private keys were exfiltrated. The script abused the trading permissions of the open session instead.
- 726 wallets were affected, with about $2.7M stolen directly. A further $1.19M is being paid to roughly 5,500 wallets hurt by the trading halt or by positions that were sold or transferred.
- DebugBear has not said how the registrar access was obtained. It reports no sign of compromise of its internal systems, and it cannot currently receive email on its domain.
- Polymarket had a similar third-party script injection incident in June, with about $3M in theft reported.
Remediation
- DebugBear initially told customers to remove the RUM embed code.
- Polymarket removed the compromised provider within the hour. It is working with law enforcement and has promised a postmortem.
- Defenders should lock down registrar accounts and DNS with MFA and registrar locks. They should also audit third-party scripts on sensitive web apps and consider Subresource Integrity or CSP controls.