Researchers Link Polymarket Withdrawals to DebugBear Supply-Chain Attack
Summary
Polymarket halted international trading after users reported unauthorized withdrawals linked by researchers to malicious JavaScript served through DebugBear’s RUM script. Estimated losses range from $2.19 million to $2.71 million; the tally is unverified.
Key points
- Polymarket moved its international platform to cancel-only mode and suspended relayer actions after reports of unauthorized withdrawals; trading resumed about an hour later.
- Polymarket said a third-party provider was compromised, that it had fixed the issue, and that affected traders would be reimbursed. It did not name the vendor or disclose losses.
- Researchers linked the theft to malicious JavaScript served from a DebugBear address used by Polymarket. The code targeted logged-in users’ trading tools and portfolios, then attempted to sell positions and move proceeds or transfer position tokens.
- Hudson Rock said the sample read credential-related material but did not identify code that sent passwords, seed phrases, private keys, or the credential map to its reporting endpoint; it described the script as reusing authority available in the authenticated application.
- Hudson Rock said a screenshot showed about $2.19 million at the script’s fallback address, but this was not a verified loss tally. GoPlus estimated losses of roughly $2.71 million; its analysis identified 710 deposit wallets and 731 addresses, not a victim count.
- DebugBear confirmed it was affected by an ongoing security incident and advised users of its RUM product to remove its snippet. Polymarket’s US platform was reportedly unaffected.
Article Details
- Victim Organization
- Polymarket
- Victim Domain
- Polymarket.com
- Incident Type
- Third-party supply-chain compromise involving malicious JavaScript served through DebugBear’s real user monitoring (RUM) script, leading to unauthorized withdrawals from Polymarket traders.
- Affected Records
- Unknown. GoPlus reported activity involving 710 deposit wallets and 731 addresses, but the article notes that the address count does not equal the number of victims.
- Operational Impact
- Polymarket halted trading on its international platform, initially placing it in cancel-only mode and suspending relayer actions. Trading resumed about an hour later; the US platform was reportedly unaffected. Polymarket said it would reimburse affected traders. Hudson Rock cited a screenshot showing about $2.19 million at the script’s hard-coded fallback address, but said this was not a verified tally. GoPlus estimated losses at roughly $2.71 million, while Arkham data showed a suspected attacker wallet holding approximately $2.65 million.
- Claim Status
- confirmed