Polymarket Says It Will Pay $3.9 Million After Malicious Script Attack
Summary
Polymarket says it will pay $3.9 million after a malicious script reportedly used logged-in traders’ sessions to move assets. DebugBear disclosed compromised DNS records; the attackers’ access method remains unknown.
Key points
- Polymarket halted trading on its international platform on October 29 after users reported unauthorized withdrawals.
- Hudson Rock researchers linked the activity to malicious JavaScript served from a DebugBear address loaded by Polymarket’s site.
- The script targeted logged-in traders and reportedly moved assets using their open-session trading permissions. Hudson Rock found no evidence it sent passwords, seed phrases or private keys to the attacker.
- Polymarket said 726 wallets were affected; as of its October 30 update, 37 were still awaiting payment after their details were checked.
- Polymarket says its total payout is $3.9 million: roughly $2.7 million for direct theft and $1.19 million for traders affected by the trading halt or altered positions.
- Polymarket said it removed the third-party provider within an hour and is investigating with law enforcement.
- DebugBear said attackers compromised its DNS records through its domain registrar. Its investigation is ongoing; the company reported no indication of internal-system compromise and has not explained how registrar-level access was obtained.
Article Details
- Victim Organization
- Polymarket
- Incident Type
- Supply-chain attack involving a compromised third-party provider and malicious JavaScript loaded by Polymarket's site.
- Data Types Exposed
- Credential-related data stored in the browser was read by the script; Hudson Rock reported no evidence that passwords, seed phrases, or private keys were sent to the attacker.
- Affected Records
- Polymarket said 726 wallets were affected. It also paid compensation across roughly 5,500 wallets for losses related to the trading halt or positions sold or transferred by the script.
- Affected Data Size
- Approximately $2.7 million was stolen directly; Polymarket said total payouts were $3.9 million.
- Operational Impact
- Polymarket halted trading on its international platform after users reported unauthorized withdrawals. The malicious script dumped positions or transferred assets to an attacker-chosen wallet.
- Ransom Or Extortion
- No ransom or extortion activity was reported. Polymarket said it was reimbursing affected traders.
- Claim Status
- confirmed