Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script

Hackers stole about $2.7 million from Polymarket traders after malicious code on the prediction market website sold some signed-in users' positions and moved funds to the attackers on October 29. The code replaced a page-speed script that Polymarket loaded from outside company DebugBear. Polymarket says it is refunding about $2.7 million to 726 affected wallets.

How the hijacked script worked

Researchers at Hudson Rock downloaded the malicious file on October 29 from the address Polymarket's site used to load the DebugBear script. They also found a change in Polymarket's site code that removed the DebugBear script. DebugBear said its DNS records were compromised through its domain registrar. Its early findings indicate the attack targeted one customer's website, and it has seen no sign of a break-in to its own systems though it is still looking.

Hudson Rock found after reviewing the file without running it that the code reused access a signed-in trader already had in an open Polymarket page. It read account details kept in the browser, including trading API keys. Those keys alone cannot place an order because orders also need a wallet signature. The code searched for the part of Polymarket's site that places orders and for the signer that approves transactions. For accounts that sign in with their own crypto wallet, it moved positions to the hackers' wallet. For email accounts, it sold positions at ever-worse prices and moved the money out.

Funds and refunds

Blockchain records show crypto worth about $2.64 million reached the hackers' wallet in under an hour. The wallet collected 28.6 million POL tokens and positions from 33 wallets, according to Ohey's blockchain trace. At 18:19 UTC, those 28.6 million POL were worth about $2.64 million at DefiLlama's price of $0.0922, DefiPrime calculated. The figure covers only the POL, not the positions.

Polymarket posted its first status update about unauthorized activity in user wallets at 17:38 UTC. At 18:05 UTC, it said its exchange was in cancel-only mode, with relayer actions paused. The company said it removed the script within the hour, cleared every cache, reset all active login sessions and paused trading until the site was clean. It has referred the case to law enforcement. By October 30, 689 of the 726 affected wallets had been refunded in full, and the remaining 37 were being paid as they were checked. Polymarket is also paying $1.19 million to about 5,500 wallets that lost money during the trading pause or had positions taken. In all, it is returning $3.9 million to traders.

What sites and traders can do

DebugBear has told customers of its real user monitoring product to remove its embed code from their websites. The address that served the malicious file, cdn.debugbear[.]com, had no DNS record when checked on November 1. Polymarket said it is putting third-party scripts back in place with extra checks, such as a stronger Content Security Policy, pinned versions and sandboxing.

Hudson Rock's advice for sites that load outside scripts is to keep unneeded third-party code off pages where users trade or sign. Where a file can be pinned, use Subresource Integrity, which lets the browser reject the file if its contents change. Hudson Rock's advice for traders is to reject any signing request they did not expect.

Sources: The Hacker News