Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script
Malicious code on the website of prediction market Polymarket sold some signed-in traders' positions and moved their funds to the hackers on October 29. The code had replaced a page-speed script that the site loaded from an outside company. Polymarket says it is refunding about $2.7 million to 726 affected wallets. Blockchain records show crypto worth about $2.64 million reached
On October 29, hackers stole approximately $2.64 million from Polymarket traders by hijacking a DebugBear script that Polymarket used to measure web page load times. The malicious code replaced the legitimate script, allowing the hackers to access trader positions and move funds to their own crypto wallet. Polymarket refunded about $2.7 million to 726 affected wallets, with the remaining $1.19 million paid to traders who lost money during the trading pause.
DebugBear, which provides a RUM tool for web page load speed, experienced compromised DNS records due to a domain registrar issue. Researchers found that the malicious file removed DebugBear's script and accessed the trader's API keys and trading permissions to take positions. Polymarket is strengthening its security measures, including implementing a stronger Content Security Policy, pinned versions, and sandboxing. The company has also referred the case to law enforcement.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
