Hackers Exploit Compromised Third-Party Script to Steal $2.7M from Polymarket Users
Attackers injected malicious code into Polymarket's website via a hijacked performance monitoring script. The breach led to unauthorized fund transfers from 726 trader wallets.
TL;DR
- Malicious actors compromised DebugBear’s script used by Polymarket.
- The injected code executed unauthorized transactions from logged-in user accounts.
- $2.7 million was stolen before the breach was detected and halted.
- Polymarket has committed to fully refunding all affected users.
- The incident highlights risks of third-party scripts in web applications.
In a sophisticated supply chain attack, cybercriminals exploited a third-party page-speed monitoring tool to inject malicious code into the Polymarket trading platform. On October 29, the rogue script targeted signed-in users, siphoning off funds by initiating unauthorized trades and withdrawals.
Blockchain analysis confirmed that approximately $2.64 million in cryptocurrency was moved to attacker-controlled wallets. In response, Polymarket announced it would reimburse the full $2.7 million across 726 impacted wallets, emphasizing its commitment to user security despite the external vector of compromise.
How the Attack Worked
- Hackers gained control of DebugBear's script-loading infrastructure.
- They replaced a legitimate performance-monitoring script with a malicious version.
- When Polymarket loaded the script, it unknowingly executed attacker-controlled JavaScript.
- Authenticated users were specifically targeted while active on the trading platform.
- The script initiated unauthorized sell-offs and wallet transfers in real time.
Response and Implications
- Polymarket identified the breach within hours and took the site offline temporarily.
- All 726 affected wallets will be refunded in full, according to company statements.
- The incident underscores the critical need for subresource integrity (SRI) checks.
- Organizations relying on third-party scripts must implement strict content security policies.
- Supply chain attacks remain a top threat due to limited visibility into external dependencies.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.