Cyberattack on Polymarket: $2.7 million stolen

On Thursday (29 October), an estimated $2.7 million was stolen from hundreds of accounts on Polymarket's international platform. The attackers took over the software of a third-party provider the company uses. The platform then temporarily halted transactions and announced that it would cover the losses of affected users.

Blockchain analysis firm Bubblemaps estimates that about 700 users were affected. The company has not yet verified the number of victims or the amount stolen, but said the issue has been resolved. The incident affected only the international cryptocurrency-based exchange Polymarket.com. Polymarket US, which operates under US financial regulations, was not affected by the attack.

Security researchers found that JavaScript code embedded in the Polymarket website had been tampered with. The malicious code ran when users visited the site. Hudson Rock researchers, meanwhile, detected a modified script in the infrastructure of DebugBear, a UK-based web performance monitoring software provider. The script was attempting to abuse users' open sessions.

According to BleepingComputer's analysis, the code checked users' crypto balances and open prediction positions, and tried to sell their assets or transfer them to the attackers' wallet. This means users could lose money even if they did not share their passwords or click a phishing link. Chain analysis showed that about $2.57 million worth of Polygon POL cryptocurrency was transferred from one attacker wallet to three different addresses.

DebugBear acknowledged an ongoing security incident and asked its customers to remove the embedded code of the relevant product from their sites. Polymarket, noting that the problem occurred at a third-party provider, reported the incident to UK police. At 14:05, the platform switched to cancel-only mode and returned to normal trading about an hour later.