Hackers compromised a third-party script on the cryptocurrency prediction market Polymarket on October 29, stealing approximately $2.7 million from 726 traders. The malicious code replaced a legitimate page-speed monitoring tool from DebugBear by exploiting compromised DNS records at the company’s domain registrar. The attackers used the script to access traders’ browser data, including API keys, and then transferred their positions and funds to attacker-controlled wallets within approximately one hour.
Polymarket responded by pausing trading, removing the malicious script, clearing caches, and resetting all active sessions. The company has refunded the $2.7 million to affected users and is providing an additional $1.19 million in compensation to approximately 5,500 other traders who experienced losses during the incident or trading halt. DebugBear has advised customers to remove its code and is investigating the breach, though preliminary findings suggest only one customer’s website was targeted and the company’s own systems remain secure.
Source: Read the full story at The Hacker News
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
