Hijacked Website Script Lets Hackers Drain About $2.7 Million From Polymarket Traders

Malicious code on the website of prediction market Polymarket sold some signed-in traders' positions and moved their funds to the hackers on October 29. The code had replaced a page-speed script that the site loaded from an outside company, DebugBear. Polymarket says it is refunding about $2.7 million to 726 affected wallets, and blockchain records show crypto worth about $2.64 million reached the hackers' wallet in under an hour.

DebugBear said its DNS records were compromised through its domain registrar. Its early findings indicate the attack targeted one customer's website, and it has seen no sign of a break-in to its own systems, though it is still looking. Researchers at Ohey found a different server answering for DebugBear's addresses at 18:13 UTC, while the malicious file was still online. Each customer loads its own copy of the script, and the file that was swapped was Polymarket's.

Hudson Rock reviewed the file without running it. The code uses the access a signed-in trader already has in an open Polymarket page and reads account details stored in the browser. It found no part of the code that sends passwords, seed phrases or private keys to the attackers' server. Instead, the code finds the part of the site that places orders and the signer that approves transactions. Accounts using their own crypto wallet had positions moved straight to the hackers. Email sign-in accounts had positions sold at ever-worse prices before the money was moved out.