Quick Takeaways
- A compromised DebugBear script injected malicious code into Polymarket after DebugBear’s DNS was hijacked.
- The code abused signed-in sessions to sell or transfer traders’ positions; about $2.64 million in crypto reached attackers.
- Polymarket is refunding traders: roughly $2.7 million to 726 affected wallets, plus $1.19 million for other losses.
- Key defenses: remove unnecessary third-party scripts, verify files with SRI, sandbox scripts, and reject unexpected signing requests.
A Hijacked Script Drained Trader Accounts
On October 29, malicious code on Polymarket sold some traders’ positions and redirected funds to hackers. The code replaced a page-speed script that Polymarket loaded from DebugBear, an outside service.
Polymarket says the incident affected 726 wallets. Blockchain records show the hackers’ wallet received about $2.64 million in crypto within an hour. The company plans to return about $2.7 million to those traders.
The code took advantage of traders who were already signed in. It found Polymarket’s trading tools and asked the account’s own wallet signer to approve transactions. For some wallet-based accounts, it transferred positions. For email-based accounts, it sold positions at increasingly poor prices, then moved the proceeds.
Researchers found no sign that the code sent passwords, private keys, or recovery phrases to the hackers. However, a signing request does not prove that a trader approved it without seeing a prompt; wallet providers may apply their own checks.
DebugBear said attackers compromised its domain records through its registrar. Its early review found no evidence that hackers entered its systems, and it said the attack appeared to target one customer’s site.
Refunds and Lessons for Online Services
Polymarket removed the script, paused trading, ended active login sessions, and referred the case to law enforcement. By October 30, it had refunded 689 of the 726 affected wallets and was checking the remaining payments. It also pledged $1.19 million to about 5,500 traders affected by the trading pause or stolen positions, bringing its planned payouts to $3.9 million.
The incident shows how a small piece of outside code can create serious risks when it runs on a signed-in financial site. Third-party tools can help websites track speed and improve service. Yet sites should limit those tools on pages where people trade or approve payments.
Polymarket says it will add checks before restoring outside scripts. Other services can also restrict what those scripts may do and verify that files have not changed. For users, the practical lesson is simple: question unexpected requests to approve a transaction. As more daily activity moves online, trust depends not only on the main service but also on every tool it connects to.
Expand Your Tech Knowledge
Learn how the Internet of Things (IoT) is transforming everyday life.
Stay inspired by the vast knowledge available on Wikipedia.
DataProtection-V1
