- Messages
- 94
- Likes
- 10
- Points
- 8
The Polymarket platform temporarily suspended trading after hackers compromised the third-party service DebugBear and distributed malicious JavaScript through it. The script hijacked authorized sessions and attempted to steal users' cryptocurrency. Security researchers attribute the attack to a wallet through which approximately $2.57 million was transferred.
Polymarket representatives report that the hack affected Polymarket.com, but the compromise has now been resolved, and all information about the attack has been passed on to law enforcement. The platform promises to fully compensate all affected users.
While the investigation continued, Polymarket first switched to cancel-only mode, prohibiting new trades, and then suspended relay operations. About half an hour later, company specialists reported that the issue had been resolved, but trading was left disabled as a precaution. The prediction market ultimately resumed operations approximately an hour after the incident began.
Experts from Hudson Rock report that malicious JavaScript was distributed from the domain cdn.debugbear[.]com. DebugBear is a Real User Monitoring (RUM) service: its JavaScript is embedded into websites and collects performance metrics, helping to monitor loading speed and website performance for real users.
DebugBear representatives soon confirmed that they were investigating the ongoing security incident and urged clients to immediately remove the RUM code from their websites.
Analysis of the malicious script revealed that it checked whether the user was logged in to Polymarket and, if an active session was present, used the platform's standard trading functions to perform unauthorized transactions. The malware determined the user's wallet balances and positions on prediction markets, then chose a cryptocurrency theft method based on the authentication method.
In some cases, the script attempted to automatically sell the victim's positions, while in others, it directly transferred tokens to the attackers' wallet. Furthermore, the malware attempted to convert the user's cryptocurrency into other assets, which could then be withdrawn from the platform.
To receive commands and send information about accounts, wallet addresses, balances, and transaction results, the script accessed data.debugbear[.]com. This means that DebugBear's infrastructure was used not only to distribute the malware but also as a command and control server and a channel for data exfiltration. The level of access the attackers gained to DebugBear's systems remains unclear.
Hudson Rock researchers note that they have found a wallet believed to be linked to this attack, from which approximately 28.6 million POL, worth approximately $2.57 million, was transferred to three other addresses. However, the exact extent of the damage is still unknown: Polymarket representatives are not disclosing how many users were affected by the attack or how much cryptocurrency the hackers managed to steal. @ xakep.ru
Polymarket representatives report that the hack affected Polymarket.com, but the compromise has now been resolved, and all information about the attack has been passed on to law enforcement. The platform promises to fully compensate all affected users.
While the investigation continued, Polymarket first switched to cancel-only mode, prohibiting new trades, and then suspended relay operations. About half an hour later, company specialists reported that the issue had been resolved, but trading was left disabled as a precaution. The prediction market ultimately resumed operations approximately an hour after the incident began.
Experts from Hudson Rock report that malicious JavaScript was distributed from the domain cdn.debugbear[.]com. DebugBear is a Real User Monitoring (RUM) service: its JavaScript is embedded into websites and collects performance metrics, helping to monitor loading speed and website performance for real users.
DebugBear representatives soon confirmed that they were investigating the ongoing security incident and urged clients to immediately remove the RUM code from their websites.
| Photo: BleepingComputer |
In some cases, the script attempted to automatically sell the victim's positions, while in others, it directly transferred tokens to the attackers' wallet. Furthermore, the malware attempted to convert the user's cryptocurrency into other assets, which could then be withdrawn from the platform.
To receive commands and send information about accounts, wallet addresses, balances, and transaction results, the script accessed data.debugbear[.]com. This means that DebugBear's infrastructure was used not only to distribute the malware but also as a command and control server and a channel for data exfiltration. The level of access the attackers gained to DebugBear's systems remains unclear.
Hudson Rock researchers note that they have found a wallet believed to be linked to this attack, from which approximately 28.6 million POL, worth approximately $2.57 million, was transferred to three other addresses. However, the exact extent of the damage is still unknown: Polymarket representatives are not disclosing how many users were affected by the attack or how much cryptocurrency the hackers managed to steal. @ xakep.ru